GhostMap: unpatched Android APK parser flaw traps phones in boot loops after a crafted app is installed
Bitdefender Labs disclosed GhostMap, a parser flaw in Android that leaves a phone stuck in an endless boot loop once a crafted app is installed. The app contains no executable code and requests no permissions, and the loop continues into Safe Mode, so recovery generally requires a factory reset that erases local data. The defect lies in how libziparchive and libandroidfw interpret the compression method and declared uncompressed size of a ZIP entry, which makes system_server crash on every restart (bitdefender.com). Google closed Bitdefender's two reports as Won't Fix (Not Reproducible) and out of scope, and no security patch has been published (bitdefender.com). The threat is rated high rather than critical: no persistent boot-loop attack has been observed in the wild, the victim must install the crafted app, and the effect is local, but the flaw is unpatched and its outcome is data loss.
Detalhes técnicos
The investigation started on August 12, 2026, when a banking dropper collected from the wild crashed Bitdefender's emulators during installation. The sample was wrapped with a BadPack-style packer, and the packer's ZIP header rewriting also broke the installer's parsing of the manifest, so the crash was a side effect rather than an intended feature of the malware. The root cause is a disagreement between two native Android libraries: libziparchive only checks an entry's declared uncompressed size against the file size when the method is stored, while libandroidfw only recognizes deflated and treats every other 16-bit value as stored. An attacker can therefore set an arbitrary method and a huge declared length, causing Android to memory-map a tiny file across about 16 MB of unallocated space. Any process that reads past the real end of the file receives a SIGBUS signal and is killed (bitdefender.com).
On a Google Pixel 10 running Android 17 with the August 5, 2026 security patch, the researchers reproduced the failure, and Bitdefender states that it affects all Android versions from Android 10 onward (bitdefender.com). When the malformed file is a small post-install resource that system services parse automatically, the crash hits system_server. In one capture the crash came about one second after installation and repeated 110 times while the screen stayed on the boot animation. Safe Mode does not help because the crash occurs before Safe Mode initializes (bitdefender.com). Bitdefender describes two stealthier uses that it has not observed in the wild: malforming a trojan's own icon so that the launcher, Settings or app info screens crash when the victim tries to uninstall it, and planting malformed entries that crash antivirus scanners and sandboxes that parse APKs. Bitdefender detects the malformed sample as Android.Riskware.Ghostmap.rA.
The same weakness is related to CVE-2016-6724, a 2016 Android flaw in the Input Manager Service that Google patched and rated Moderate (bitdefender.com).
Remediação
- No official patch exists for Android 10 through Android 17, so there is no vendor fix to apply yet.
- Avoid sideloading unverified APKs, since the researchers note a malicious update could also deliver the malformation after passing store review.
- Keep regular cloud backups, because the only recovery for a looping device is a factory reset that wipes local data.
- If USB debugging was enabled beforehand, an ADB script from a computer can delete the offending APK between system_server restarts; this window is narrow.
- Use a mobile security product that inspects raw ZIP header structures before installation, such as the detection Bitdefender lists as Android.Riskware.Ghostmap.rA.
Linha do tempo
-
GhostMap: unpatched Android APK parser flaw traps phones in boot loops after a crafted app is installed
ler a análise desta fonte ocultar
Bitdefender Labs disclosed GhostMap, a parser flaw in Android that leaves a phone stuck in an endless boot loop once a crafted app is installed. The app contains no executable code and requests no permissions, and the loop continues into Safe Mode, so recovery generally requires a factory reset that erases local data. The defect lies in how libziparchive and libandroidfw interpret the compression method and declared uncompressed size of a ZIP entry, which makes system_server crash on every restart (bitdefender.com). Google closed Bitdefender's two reports as Won't Fix (Not Reproducible) and out of scope, and no security patch has been published (bitdefender.com). The threat is rated high rather than critical: no persistent boot-loop attack has been observed in the wild, the victim must install the crafted app, and the effect is local, but the flaw is unpatched and its outcome is data loss.
Technical Details
The investigation started on August 12, 2026, when a banking dropper collected from the wild crashed Bitdefender's emulators during installation. The sample was wrapped with a BadPack-style packer, and the packer's ZIP header rewriting also broke the installer's parsing of the manifest, so the crash was a side effect rather than an intended feature of the malware. The root cause is a disagreement between two native Android libraries: libziparchive only checks an entry's declared uncompressed size against the file size when the method is stored, while libandroidfw only recognizes deflated and treats every other 16-bit value as stored. An attacker can therefore set an arbitrary method and a huge declared length, causing Android to memory-map a tiny file across about 16 MB of unallocated space. Any process that reads past the real end of the file receives a SIGBUS signal and is killed (bitdefender.com).
On a Google Pixel 10 running Android 17 with the August 5, 2026 security patch, the researchers reproduced the failure, and Bitdefender states that it affects all Android versions from Android 10 onward (bitdefender.com). When the malformed file is a small post-install resource that system services parse automatically, the crash hits system_server. In one capture the crash came about one second after installation and repeated 110 times while the screen stayed on the boot animation. Safe Mode does not help because the crash occurs before Safe Mode initializes (bitdefender.com). Bitdefender describes two stealthier uses that it has not observed in the wild: malforming a trojan's own icon so that the launcher, Settings or app info screens crash when the victim tries to uninstall it, and planting malformed entries that crash antivirus scanners and sandboxes that parse APKs. Bitdefender detects the malformed sample as Android.Riskware.Ghostmap.rA.
The same weakness is related to CVE-2016-6724, a 2016 Android flaw in the Input Manager Service that Google patched and rated Moderate (bitdefender.com).
Remediation
- No official patch exists for Android 10 through Android 17, so there is no vendor fix to apply yet.
- Avoid sideloading unverified APKs, since the researchers note a malicious update could also deliver the malformation after passing store review.
- Keep regular cloud backups, because the only recovery for a looping device is a factory reset that wipes local data.
- If USB debugging was enabled beforehand, an ADB script from a computer can delete the offending APK between system_server restarts; this window is narrow.
- Use a mobile security product that inspects raw ZIP header structures before installation, such as the detection Bitdefender lists as Android.Riskware.Ghostmap.rA.