GhostMap: Unpatched Android ZIP-Parsing Bug Can Brick Devices via Crash Loop
Bitdefender researchers disclosed GhostMap, a flaw in the Android OS itself that mishandles two fields in a ZIP entry (the compression method and declared uncompressed length), causing a SIGBUS crash when a process reads the malformed file. The bug affects all Android versions from Android 10 upward and triggers a crash loop that persists after reboot and in safe mode, leaving a factory reset (and full data loss) as the only recovery option. Bitdefender notified Google on August 20, but Google has stated the issue is outside the scope of a security fix, so no patch is currently available. Researchers warn the bug could be weaponized to brick devices for extortion, make malicious apps unremovable, disable mobile security tools and sandboxes, or be slipped in via a later app update to evade app-store checks.
Entenda a falha
A vulnerabilidade
GhostMap is an unpatched flaw in the Android OS itself (no CVE assigned) in how ZIP/resource entries are parsed. The system mishandles two fields of a ZIP entry, the compression method and the declared uncompressed length, and any process that reads such a file gets a SIGBUS crash. An attacker needs a crafted file delivered to the device, for example inside an app, and no special privileges are described. The result is a crash loop that survives reboot and safe mode, so only a factory reset (losing local data) recovers the phone. All versions from Android 10 upward are affected and no fix exists.
Como funciona
A malformed ZIP entry, such as a resource inside an APK, reaches Android's resource-parsing code. Android reads the compression method and declared uncompressed length and maps the file into memory based on them. Because of the malformed values, the mapping covers memory that was never allocated. When a process, such as system_server, the launcher or a scanner, later reads from that empty region, the CPU raises SIGBUS and the process is killed. Since the system keeps touching the file, the crash repeats.
Por que é vulnerável
According to Bitdefender, the root cause is a native OS defect in ZIP/resource parsing: the declared fields of the entry are not validated against what is actually present, so Android maps the file across memory that was never allocated. The articles do not explain why it went unnoticed. Google has said the issue is outside the scope of a security fix, so nothing has changed in the code.
Como foi descoberta
Bitdefender found it when an APK collected in the wild crashed emulators in its labs; analysis showed the cause was not malware but a bug in Android itself. It notified Google on August 20, and Google replied that the issue is outside the scope of a security fix. Bitdefender then disclosed it publicly in a blog post, naming it GhostMap.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 08:18.
Detalhes técnicos
The root cause lies in Android's ZIP/resource parsing logic: a malformed entry causes the OS to map the file across memory that was never allocated, and the crash occurs when a process subsequently reads from that invalid memory region. Bitdefender first discovered the issue after an APK collected in the wild crashed emulators in its labs, and determined the trigger was not malware but a native OS defect. The vendor outlined four abuse scenarios: bricking a phone via a malicious app with a crafted resource read by system_server; creating apps that cannot be uninstalled because the launcher, Settings app list, and app info screen all crash when accessed; disabling security scanners, sandboxes and analysis pipelines that must parse the resource to inspect suspect APKs; and smuggling the malformed file into a trusted app via a later update to bypass app-store review.
Remediação
No official fix is available from Google as of publication. Bitdefender recommends detecting the malformed file structurally before it is ever installed or executed, since the malformation is visible by static inspection rather than requiring runtime execution. Bitdefender detects the issue as Android.Riskware.Ghostmap.rA.
Linha do tempo
-
GhostMap: Unpatched Android ZIP-Parsing Bug Can Brick Devices via Crash Loop
ler a análise desta fonte ocultar
Bitdefender researchers disclosed GhostMap, a flaw in the Android OS itself that mishandles two fields in a ZIP entry (the compression method and declared uncompressed length), causing a SIGBUS crash when a process reads the malformed file. The bug affects all Android versions from Android 10 upward and triggers a crash loop that persists after reboot and in safe mode, leaving a factory reset (and full data loss) as the only recovery option. Bitdefender notified Google on August 20, but Google has stated the issue is outside the scope of a security fix, so no patch is currently available. Researchers warn the bug could be weaponized to brick devices for extortion, make malicious apps unremovable, disable mobile security tools and sandboxes, or be slipped in via a later app update to evade app-store checks.
Technical Details
The root cause lies in Android's ZIP/resource parsing logic: a malformed entry causes the OS to map the file across memory that was never allocated, and the crash occurs when a process subsequently reads from that invalid memory region. Bitdefender first discovered the issue after an APK collected in the wild crashed emulators in its labs, and determined the trigger was not malware but a native OS defect. The vendor outlined four abuse scenarios: bricking a phone via a malicious app with a crafted resource read by system_server; creating apps that cannot be uninstalled because the launcher, Settings app list, and app info screen all crash when accessed; disabling security scanners, sandboxes and analysis pipelines that must parse the resource to inspect suspect APKs; and smuggling the malformed file into a trusted app via a later update to bypass app-store review.
Remediation
No official fix is available from Google as of publication. Bitdefender recommends detecting the malformed file structurally before it is ever installed or executed, since the malformation is visible by static inspection rather than requiring runtime execution. Bitdefender detects the issue as Android.Riskware.Ghostmap.rA.