GhostMap Flaw Lets Unprivileged Android App Trigger Persistent Boot Loop
Bitdefender disclosed a vulnerability dubbed GhostMap affecting Android that allows a malicious app requiring no permissions and no execution to put a device into a persistent boot loop. The flaw was discovered while analyzing an Android banking trojan that crashed test emulators when reading an application resource. Bitdefender reported the issue to Google on August 20, 2026, but it was marked 'Won't Fix (Not Reproducible)'; a follow-up submission on August 25 was still deemed out of scope. As of publication, no patch exists, and recovery options are limited to a factory reset or a timing-sensitive ADB-based file deletion.
Detalhes técnicos
GhostMap stems from two Android libraries interpreting ZIP compression methods differently, allowing a malformed APK to bypass size checks and be memory-mapped beyond the file's actual contents. Reading the malformed entry triggers a SIGBUS signal that crashes whichever process touches the file. Bitdefender built a proof-of-concept app with no executable code and no requested permissions that embeds a resource automatically read by the core system_server process after installation, causing an immediate crash-restart-crash loop. On a Pixel 10 running Android 17 (August 5 patch level), the crash loop repeated 110 times in normal boot mode and 72 times in Safe Mode, and also blocks access to Safe Mode, which would normally allow troubleshooting.
Remediação
There is currently no official patch. Bitdefender notes the only mitigation window is at app installation time, where third-party security tools may detect and warn about a suspicious app, though they lack permission to block installation outright. Affected users can recover via a factory reset (data loss) or by deleting the malformed file through ADB, which requires debugging already enabled and action before the crash occurs.
Linha do tempo
-
GhostMap Flaw Lets Unprivileged Android App Trigger Persistent Boot Loop
ler a análise desta fonte ocultar
Bitdefender disclosed a vulnerability dubbed GhostMap affecting Android that allows a malicious app requiring no permissions and no execution to put a device into a persistent boot loop. The flaw was discovered while analyzing an Android banking trojan that crashed test emulators when reading an application resource. Bitdefender reported the issue to Google on August 20, 2026, but it was marked 'Won't Fix (Not Reproducible)'; a follow-up submission on August 25 was still deemed out of scope. As of publication, no patch exists, and recovery options are limited to a factory reset or a timing-sensitive ADB-based file deletion.
Technical Details
GhostMap stems from two Android libraries interpreting ZIP compression methods differently, allowing a malformed APK to bypass size checks and be memory-mapped beyond the file's actual contents. Reading the malformed entry triggers a SIGBUS signal that crashes whichever process touches the file. Bitdefender built a proof-of-concept app with no executable code and no requested permissions that embeds a resource automatically read by the core system_server process after installation, causing an immediate crash-restart-crash loop. On a Pixel 10 running Android 17 (August 5 patch level), the crash loop repeated 110 times in normal boot mode and 72 times in Safe Mode, and also blocks access to Safe Mode, which would normally allow troubleshooting.
Remediation
There is currently no official patch. Bitdefender notes the only mitigation window is at app installation time, where third-party security tools may detect and warn about a suspicious app, though they lack permission to block installation outright. Affected users can recover via a factory reset (data loss) or by deleting the malformed file through ADB, which requires debugging already enabled and action before the crash occurs.