GhostMap: Unpatched Android ZIP-parsing flaw lets a permission-less APK force a persistent boot loop; Google won't fix
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 06/11/2026 04:03; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ infosecurity-magazine.com ↗ bleepingcomputer.com ↗ helpnetsecurity.com ↗
Bitdefender Labs disclosed GhostMap on November 5, 2026. It is an unpatched flaw in how Android parses ZIP structures inside APK files. A crafted app with no executable code, no permissions and no need to be launched can put a device into a persistent crash loop. Bitdefender found the bug after an in-the-wild banking dropper/trojan sample crashed its analysis emulators, and concluded the cause was a native OS defect rather than malware logic (helpnetsecurity.com, bleepingcomputer.com, infosecurity-magazine.com). Google closed the initial report as Won't Fix (Not Reproducible) and later judged a working proof-of-concept out of scope for a security patch, so no fix is planned. No CVE has been assigned because Google did not accept the bug through its vulnerability program, and Bitdefender has not observed exploitation in the wild (helpnetsecurity.com). Recovery may require a factory reset with data loss, though this is not permanent hardware damage (gbhackers.com).
Entenda a falha
A vulnerabilidade
GhostMap is an unpatched flaw (no CVE, because Google did not accept it into its vulnerability program) in how Android parses ZIP entries inside APKs. An entry with an undefined compression method and a large declared size gets past two libraries' checks. The attacker only needs the victim to install a crafted APK with no code and no permissions, and the app need not be launched. The result is a SIGBUS in the process reading the file, and if that is system_server it becomes a persistent crash loop that also survives Safe Mode. AOSP from Android 10 to the latest release is affected, OEM builds were not tested, and no fix is planned. Bitdefender saw no exploitation in the wild.
Como funciona
An APK containing a ZIP entry with a compression method other than stored or deflated is installed. When a process reads that entry, such as the installer reading a manifest or system_server reading a resource, one library skips the size check because the method is not stored. The other library treats any non-deflated method as stored and memory-maps the file at the declared size. The kernel allows a mapping larger than the file (an 8,408-byte APK was mapped across about 16 MB). The first read past the real end of the file raises SIGBUS and kills the reading process. system_server restarts and rereads the same file, so the crash repeats.
Por que é vulnerável
Two Android libraries interpret the 16-bit compression method differently. libziparchive validates the declared uncompressed size against the available file space only when the method is explicitly stored, so undefined values escape the check. libandroidfw treats every method other than deflate as stored and maps the declared length without validating it. The inconsistent assumptions leave a gap that a malformed entry crosses. The articles do not say why it went unnoticed. Google closed the report as Won't Fix (Not Reproducible) and later called it out of scope for a security fix, so nothing in the code has changed.
Onde está
The libziparchive and libandroidfw libraries in Android/AOSP, as named by GBHackers; no file, function or commit is named.
Como foi descoberta
On August 12, 2026 a banking dropper collected in the wild crashed Bitdefender's analysis emulators during installation. A packer had rewritten the APK structure, and Bitdefender concluded the cause was an Android bug rather than malware logic. Its researchers then built the persistent crash demonstration themselves. Bitdefender reported to Google on August 20 (closed as Won't Fix, Not Reproducible) and sent a follow-up with a working PoC on August 25, which Google still judged out of scope, passing it to a team for possible future consideration. Bitdefender told Google at the end of October it would publish, and disclosed on November 5, 2026. Zimperium's earlier research on malformed APKs only affected analysis tools.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Bitdefender built a demonstration app with no executable code and no permissions that does not need to be launched. It embeds a resource that system_server reads automatically after installation, which triggers the crash loop about one second later. On a Pixel 10 with Android 17 (August 5, 2026 patch) it looped 110 times in normal boot and 72 times in Safe Mode. It shows a denial of service only, not code execution, privilege escalation or data theft. The articles do not say it was released: it was shared with Google, so treat it as private. Since the flaw is unpatched and the malformation is detectable by static inspection, detection before install is the main defense.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 04:18.
Detalhes técnicos
- Root cause: ZIP entries declare a 16-bit compression method and an uncompressed size. Android officially supports only stored and deflated. One Android library validates the declared size only for stored entries. Another treats any non-deflated method as stored and memory-maps the file to the declared size. A crafted entry with an undefined compression method therefore bypasses both checks (helpnetsecurity.com, bleepingcomputer.com).
- Crash mechanism: The kernel permits mappings larger than the backing file. In Bitdefender's test an 8,408-byte APK was mapped across roughly 16 MB. The first out-of-bounds read raises SIGBUS in whichever process reads the entry (helpnetsecurity.com).
- Impact by target: A malformed manifest crashes the installer. A malformed resource read by system_server crashes that core process repeatedly, because it rereads the same file after every restart (helpnetsecurity.com).
- Proof-of-concept: It has no executable code and requests no permissions. It embeds a resource that system_server reads automatically after installation. It was tested on a Pixel 10 running Android 17 (August 5, 2026 patch level) (helpnetsecurity.com, bleepingcomputer.com).
- Crash counts: The loop repeated 110 times in normal boot and 72 times in Safe Mode, and it also blocks access to Safe Mode (bleepingcomputer.com).
- Affected versions: AOSP from Android 10 through the latest release. OEM-specific builds were not tested (helpnetsecurity.com, infosecurity-magazine.com).
- Prior research: Earlier Zimperium research on malformed APKs only broke analysis tools and decompilation. GhostMap turns the same parser gap into an out-of-bounds read that affects the calling process, including the system process (helpnetsecurity.com).
- Abuse scenarios outlined by Bitdefender (infosecurity-magazine.com):
- Bricking a phone, for example for extortion, through a crafted resource read by system_server.
- Apps that cannot be uninstalled, because the launcher, the Settings app list and the app info screen crash when accessed.
- Disabling security scanners, sandboxes and analysis pipelines that must parse the resource.
- Slipping the malformed file into a trusted app via a later update to evade app-store review.
- Bitdefender declined to say whether a booby-trapped app could pass Google Play review, citing legal risk under Directive 2013/40/EU (helpnetsecurity.com).
Remediação
- No official patch exists and none is planned. Google routed the issue to a product team for possible future consideration (helpnetsecurity.com).
- Detection before installation: Bitdefender recommends detecting the malformed file structurally before install or execution, since the malformation is visible by static inspection. It detects the issue as Android.Riskware.Ghostmap.rA (infosecurity-magazine.com).
- Install-time warnings: Third-party security tools may warn about a suspicious app at install time but cannot block the installation (bleepingcomputer.com).
- Recovery: Options are a factory reset (data loss) or deleting the malformed file via ADB. The ADB route requires debugging to be already enabled and action before the crash occurs (bleepingcomputer.com).
Relatos divergentes
- Disclosure timeline: Bleepingcomputer.com and infosecurity-magazine.com say Bitdefender reported the issue to Google on August 20, 2026. Bleepingcomputer.com adds that a follow-up on August 25 was still deemed out of scope. Helpnetsecurity.com gives no dates.
- Recovery options: Helpnetsecurity.com says a factory reset is required "in some cases". Infosecurity-magazine.com calls a factory reset the only recovery option. Bleepingcomputer.com, the most detailed on this point, also describes a timing-sensitive ADB file deletion.
- Safe Mode: Helpnetsecurity.com says the loop is reproducible in safe mode and cites 110 cycles on the boot animation. Bleepingcomputer.com separates the counts (110 normal, 72 Safe Mode) and says Safe Mode access is blocked. The sources agree that Safe Mode is no escape.
Linha do tempo
-
New GhostMap Android Vulnerability Can Crash Phones Permanently Without Opening an App or Granting Permissions
ler a análise desta fonte ocultar
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can cause phones to become stuck in a continuous crash loop immediately after a specially crafted application is installed.
The demonstration app contains no executable code, requests no permissions, and does not need to be launched. To recover, users may need to perform a factory reset, which will erase locally stored data, although this does not indicate permanent hardware damage.
-
GhostMap: Unpatched Android ZIP-Parsing Bug Can Brick Devices via Crash Loop
ler a análise desta fonte ocultar
Bitdefender researchers disclosed GhostMap, a flaw in the Android OS itself that mishandles two fields in a ZIP entry (the compression method and declared uncompressed length), causing a SIGBUS crash when a process reads the malformed file. The bug affects all Android versions from Android 10 upward and triggers a crash loop that persists after reboot and in safe mode, leaving a factory reset (and full data loss) as the only recovery option. Bitdefender notified Google on August 20, but Google has stated the issue is outside the scope of a security fix, so no patch is currently available. Researchers warn the bug could be weaponized to brick devices for extortion, make malicious apps unremovable, disable mobile security tools and sandboxes, or be slipped in via a later app update to evade app-store checks.
Technical Details
The root cause lies in Android's ZIP/resource parsing logic: a malformed entry causes the OS to map the file across memory that was never allocated, and the crash occurs when a process subsequently reads from that invalid memory region. Bitdefender first discovered the issue after an APK collected in the wild crashed emulators in its labs, and determined the trigger was not malware but a native OS defect. The vendor outlined four abuse scenarios: bricking a phone via a malicious app with a crafted resource read by system_server; creating apps that cannot be uninstalled because the launcher, Settings app list, and app info screen all crash when accessed; disabling security scanners, sandboxes and analysis pipelines that must parse the resource to inspect suspect APKs; and smuggling the malformed file into a trusted app via a later update to bypass app-store review.
Remediation
No official fix is available from Google as of publication. Bitdefender recommends detecting the malformed file structurally before it is ever installed or executed, since the malformation is visible by static inspection rather than requiring runtime execution. Bitdefender detects the issue as Android.Riskware.Ghostmap.rA.
-
GhostMap Flaw Lets Unprivileged Android App Trigger Persistent Boot Loop
ler a análise desta fonte ocultar
Bitdefender disclosed a vulnerability dubbed GhostMap affecting Android that allows a malicious app requiring no permissions and no execution to put a device into a persistent boot loop. The flaw was discovered while analyzing an Android banking trojan that crashed test emulators when reading an application resource. Bitdefender reported the issue to Google on August 20, 2026, but it was marked 'Won't Fix (Not Reproducible)'; a follow-up submission on August 25 was still deemed out of scope. As of publication, no patch exists, and recovery options are limited to a factory reset or a timing-sensitive ADB-based file deletion.
Technical Details
GhostMap stems from two Android libraries interpreting ZIP compression methods differently, allowing a malformed APK to bypass size checks and be memory-mapped beyond the file's actual contents. Reading the malformed entry triggers a SIGBUS signal that crashes whichever process touches the file. Bitdefender built a proof-of-concept app with no executable code and no requested permissions that embeds a resource automatically read by the core system_server process after installation, causing an immediate crash-restart-crash loop. On a Pixel 10 running Android 17 (August 5 patch level), the crash loop repeated 110 times in normal boot mode and 72 times in Safe Mode, and also blocks access to Safe Mode, which would normally allow troubleshooting.
Remediation
There is currently no official patch. Bitdefender notes the only mitigation window is at app installation time, where third-party security tools may detect and warn about a suspicious app, though they lack permission to block installation outright. Affected users can recover via a factory reset (data loss) or by deleting the malformed file through ADB, which requires debugging already enabled and action before the crash occurs.
-
GhostMap: Malformed APK ZIP Structure Can Crash Android Devices in Reboot Loop
ler a análise desta fonte ocultar
Bitdefender Labs researchers discovered GhostMap, an Android flaw stemming from how the OS parses ZIP structures inside APK files, after a banking dropper sample crashed their analysis emulators during installation. The team built a permission-less, code-free app that triggers a persistent crash loop on a Pixel 10 running Android 17 (August 5, 2026 patch level), requiring a factory reset to clear in some cases. Google has declined to issue a security fix, closing the initial report as Won't Fix (Not Reproducible) and later deeming a working proof-of-concept out of scope for a security patch, instead routing it to a product team for possible future consideration. Bitdefender states it has not observed exploitation in the wild and no CVE has been assigned since Google did not accept the bug through its vulnerability program.
Technical Details
ZIP entries declare a compression method (a 16-bit field) and an uncompressed size; Android officially supports only stored and deflated methods. One Android library validates declared size only for stored entries, while another treats any non-deflated method as stored and memory-maps the file to the declared size — a gap that lets a crafted entry with an undefined compression method bypass both checks. Because the kernel permits mappings larger than the underlying file, an 8,408-byte APK was mapped across roughly 16 MB in Bitdefender's test, and the first out-of-bounds read triggers a SIGBUS crash in the reading process. A malformed manifest crashes the installer; a malformed resource read by system_server crashes that core Android process repeatedly, since it rereads the same file on each restart — one test case showed 110 crash cycles stuck on the boot animation, reproducible even in safe mode. Bitdefender notes this differs from prior Zimperium research on malformed APKs, which only broke analysis tools and decompilation without crashing the device; GhostMap turns the same parser gap into an exploitable out-of-bounds read affecting the caller process, including the system process itself. The bug is present in AOSP from Android 10 through the latest version; the researchers did not test OEM-specific builds.
Remediation
No patch is currently planned by Google. Bitdefender declined to detail whether a booby-trapped app could bypass Google Play review or be introduced via a later update, citing legal risk under Directive 2013/40/EU around publishing information that could be considered evidence of misuse of an unpatched vulnerability.