GhostMap: Malformed APK ZIP Structure Can Crash Android Devices in Reboot Loop
Bitdefender Labs researchers discovered GhostMap, an Android flaw stemming from how the OS parses ZIP structures inside APK files, after a banking dropper sample crashed their analysis emulators during installation. The team built a permission-less, code-free app that triggers a persistent crash loop on a Pixel 10 running Android 17 (August 5, 2026 patch level), requiring a factory reset to clear in some cases. Google has declined to issue a security fix, closing the initial report as Won't Fix (Not Reproducible) and later deeming a working proof-of-concept out of scope for a security patch, instead routing it to a product team for possible future consideration. Bitdefender states it has not observed exploitation in the wild and no CVE has been assigned since Google did not accept the bug through its vulnerability program.
Entenda a falha
A vulnerabilidade
GhostMap is a flaw in how AOSP reads the ZIP structure inside APK files. An APK with a ZIP entry that declares an undefined compression method gets past the size checks in two Android libraries. An attacker only needs to get the crafted APK onto the device. Bitdefender's app has no executable code and requests no permissions, and it does not need to be opened. The result is a SIGBUS crash and a persistent crash loop that can require a factory reset. It was reproduced on a Pixel 10 with Android 17 (August 5, 2026 patch), and the bug is present in AOSP from Android 10 to the latest version. No CVE exists and Google plans no fix. OEM builds were not tested.
Como funciona
Each ZIP entry declares a compression method in a 16-bit field and an uncompressed size, and Android officially supports only stored and deflated. One library validates the declared size only for stored entries. A second treats anything that is not deflated as stored and memory-maps the file at the declared size. An entry with a third method value passes both, and the kernel allows a mapping larger than the file (an 8,408-byte APK was mapped across about 16 MB). The first read past the real end of the file raises SIGBUS and kills the reading process.
Por que é vulnerável
The two libraries make inconsistent assumptions about the same field. One validates the size only for stored entries, while the other treats every non-deflated method as stored, so an undefined method value is never checked by either. The declared size is then trusted for the memory mapping even though it exceeds the real file, which yields an out-of-bounds read. Which process crashes depends on the malformed file: a bad manifest crashes the installer, and a bad resource read by system_server crashes it on every restart because it rereads the same file. The articles describe no fix because Google has not made one.
Como foi descoberta
On August 12, a banking dropper collected from the wild crashed Bitdefender Labs' analysis emulators during installation. A packer had rewritten the APK's internal structure, and that rewrite also broke Android's installer. From this the team built a minimal app that triggers the loop. Bitdefender sent the first report to Google on August 20 and it was closed as Won't Fix (Not Reproducible). A follow-up on August 25 with a working PoC was called out of scope for a security fix and passed to a team for possible future inclusion. Bitdefender told Google in late October it would publish on November 5, and Google agreed. Bitdefender says it has not seen exploitation in the wild. Earlier Zimperium research on malformed APKs only broke analysis tools.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Bitdefender built a working app with no code and no permissions that leaves a Pixel 10 on Android 17 in a crash loop, and sent a working proof of concept to Google on August 25. The articles do not say it was published, so it appears to be held by Bitdefender and Google. One capture shows 110 crash cycles on the boot animation, also in safe mode, and some cases needed a factory reset. Bitdefender has seen no in-the-wild use, but with no patch planned, defenders should be wary of installing untrusted APKs.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 06:18.
Detalhes técnicos
ZIP entries declare a compression method (a 16-bit field) and an uncompressed size; Android officially supports only stored and deflated methods. One Android library validates declared size only for stored entries, while another treats any non-deflated method as stored and memory-maps the file to the declared size — a gap that lets a crafted entry with an undefined compression method bypass both checks. Because the kernel permits mappings larger than the underlying file, an 8,408-byte APK was mapped across roughly 16 MB in Bitdefender's test, and the first out-of-bounds read triggers a SIGBUS crash in the reading process. A malformed manifest crashes the installer; a malformed resource read by system_server crashes that core Android process repeatedly, since it rereads the same file on each restart — one test case showed 110 crash cycles stuck on the boot animation, reproducible even in safe mode. Bitdefender notes this differs from prior Zimperium research on malformed APKs, which only broke analysis tools and decompilation without crashing the device; GhostMap turns the same parser gap into an exploitable out-of-bounds read affecting the caller process, including the system process itself. The bug is present in AOSP from Android 10 through the latest version; the researchers did not test OEM-specific builds.
Remediação
No patch is currently planned by Google. Bitdefender declined to detail whether a booby-trapped app could bypass Google Play review or be introduced via a later update, citing legal risk under Directive 2013/40/EU around publishing information that could be considered evidence of misuse of an unpatched vulnerability.
Linha do tempo
-
GhostMap: Malformed APK ZIP Structure Can Crash Android Devices in Reboot Loop
ler a análise desta fonte ocultar
Bitdefender Labs researchers discovered GhostMap, an Android flaw stemming from how the OS parses ZIP structures inside APK files, after a banking dropper sample crashed their analysis emulators during installation. The team built a permission-less, code-free app that triggers a persistent crash loop on a Pixel 10 running Android 17 (August 5, 2026 patch level), requiring a factory reset to clear in some cases. Google has declined to issue a security fix, closing the initial report as Won't Fix (Not Reproducible) and later deeming a working proof-of-concept out of scope for a security patch, instead routing it to a product team for possible future consideration. Bitdefender states it has not observed exploitation in the wild and no CVE has been assigned since Google did not accept the bug through its vulnerability program.
Technical Details
ZIP entries declare a compression method (a 16-bit field) and an uncompressed size; Android officially supports only stored and deflated methods. One Android library validates declared size only for stored entries, while another treats any non-deflated method as stored and memory-maps the file to the declared size — a gap that lets a crafted entry with an undefined compression method bypass both checks. Because the kernel permits mappings larger than the underlying file, an 8,408-byte APK was mapped across roughly 16 MB in Bitdefender's test, and the first out-of-bounds read triggers a SIGBUS crash in the reading process. A malformed manifest crashes the installer; a malformed resource read by system_server crashes that core Android process repeatedly, since it rereads the same file on each restart — one test case showed 110 crash cycles stuck on the boot animation, reproducible even in safe mode. Bitdefender notes this differs from prior Zimperium research on malformed APKs, which only broke analysis tools and decompilation without crashing the device; GhostMap turns the same parser gap into an exploitable out-of-bounds read affecting the caller process, including the system process itself. The bug is present in AOSP from Android 10 through the latest version; the researchers did not test OEM-specific builds.
Remediation
No patch is currently planned by Google. Bitdefender declined to detail whether a booby-trapped app could bypass Google Play review or be introduced via a later update, citing legal risk under Directive 2013/40/EU around publishing information that could be considered evidence of misuse of an unpatched vulnerability.