Android’s GhostMap Vulnerability Triggers Unstoppable Crash Loop
Bitdefender has uncovered a flaw in Android, dubbed GhostMap, that can force a device into a persistent crash loop simply by installing a maliciously crafted application. The vulnerability, which affects devices running Android 10 and later, requires no user interaction, no permissions, and no code execution. Once installed, the app can trigger a fault in the system_server process, causing the phone to continuously reboot and remain unusable.
How a Malformed APK Hijacks the Android Kernel
The root of the problem lies in how Android handles ZIP entry data within APK files. Bitdefender discovered that the operating system mishandles two specific fields: the compression method and the declared uncompressed length. When a threat actor crafts these fields in a particular way, it can cause the Android system to map a file into an unallocated memory region. When a process attempts to read from this invalid memory space, the CPU raises a SIGBUS signal, forcing the process to crash.
🚨 New Android vulnerability can trap phones in endless boot loops without app permissions Security researchers at Bitdefender have discovered a serious Android vulnerability, dubbed GhostMap, that allows a malicious app to render a smartphone unusable simply by being installed.… pic.twitter.com/7YA3bu0L8h
What makes this attack so potent is its persistence. The vulnerability was first identified after a banking trojan, wrapped in a packer to alter its APK structure, crashed emulators during installation. This led Bitdefender to a deeper issue in Android’s core architecture. The crash loop occurs if the malformed file is read by a critical system service like system_server after installation. Unlike a simple failed installation, this creates a self-perpetuating cycle: system_server crashes, the device reboots, and on restart, system_server attempts to read the malformed file again, crashing once more.
Bitdefender successfully reproduced the issue on a Pixel 10 running Android 17 with the August 5 security patch, and found the same behavior on versions dating back to Android 10. The device started the crash loop about one second after installing the app, repeating the cycle 110 times in normal boot mode and 72 times in safe mode. The problem also persists in safe mode.
Bitdefender researchers detail GhostMap, an Android ZIP-parsing flaw that can make a crafted app trigger a persistent system crash loop, potentially requiring a data-erasing reset. Reproduced on Android 10+; no in-the-wild use observed, and Google says no security fix.…
The Anatomy of the Attack
The attack vector is disarmingly simple. The malicious app does not need to be opened or even request any permissions. The mere installation is enough to trigger the vulnerability. Bitdefender noted that the sample they analyzed was a banking dropper—a type of malware designed to deliver a banking trojan—but the core flaw is in the OS, not the malware itself. The malware author simply needs to package their app with a malformed resource file that exploits the specific parsing weakness.
The impact is a severe denial-of-service. A user is left with a choice: endure a bricked device or perform a factory reset, resulting in the loss of all locally stored data. Bitdefender has not observed this specific technique being used against victims yet, but the potential for abuse is high.
👀 GhostMap: an Android app with no code or permissions can boot-loop a phone, even in Safe Mode. If your users or fleet can sideload APKs, installing the malformed app is enough: system_server crashes on its own. Google closed the report as Won't Fix (Not Reproducible), and…
Google’s Stance on the Flaw
Bitdefender reported the GhostMap vulnerability to Google on August 20, but received a “Won’t Fix (Not Reproducible)” reply, with the issue being out of scope. Google says a relevant team is aware of the problem, and it may be fixed in a future version update.
Bitdefender argued that the bug presents a significant denial-of-service risk because it can render a device completely unusable. Google has been aware of the issue since August. This may mean a long wait for a fix, as Android 18 is unlikely to land until some point in 2027.
Users Remove Exploit with ADB
With no official patch available, users have limited options. The primary solution is a factory reset, which is a drastic measure that erases all data. However, in a limited set of circumstances, a user can remove the offending file without a reset. This requires that USB debugging was already enabled on the device before the malicious app was installed. If so, a user can connect the phone to a computer and use the Android Debug Bridge (ADB) to delete the malformed file before the system crashes again. This window of opportunity closes after a full reboot.
Bitdefender’s own mobile security product detects the malformed files, classifying them as Android.Riskware.Ghostmap.rA, and can warn users when such an app is downloaded or found on the device. However, Android’s security model prevents a third-party app from directly blocking an installation or removing another app, leaving the final decision to the user.
New Android threat uncovered: “GhostMap” lets a benign-seeming APK crash phones into endless reboot loops—no access needed, no code run. Affects Android 10+ and works even when safe mode is enabled. #Android #Vulnerability #GhostMap #MobileSecurity #Bitdefender#Android… pic.twitter.com/5kryFU8Cit
Apps Disable Phones via Exploits
An attacker could disguise the exploit in a fake utility or game to disable a victim’s phone, effectively holding their data hostage. Another, more insidious path involves an app that remains functional after installation while its malformed icon resource crashes the launcher and settings interfaces. This would make it incredibly difficult for a user to uninstall the malicious app and regain control of their device.
Any application or service using Android’s native APIs to parse APK files could be vulnerable. This includes antivirus scanners, static analysis tools, and other security products that rely on standard package inspection calls. A single malformed APK could crash these tools, creating a blind spot for malware detection.
GhostMap: the Android flaw that can lock your phone without you even opening the app.https://t.co/SMghvG4L2m#GhostMap #Android #AndroidSecurity #Bitdefender #CyberSecurity #Malware #SmartphoneSecurity #GooglePlay #TechNews #GadgetFlux pic.twitter.com/E1Q1JLxaEW
“The app contains no code and never needs to run,” said Alecsandru Cătălin Daj, Team Lead in the Mobile Security & Forensics Unit at Bitdefender.
Bitdefender researchers linked GhostMap to a long-running class of parser differential problems in Android, where different components interpret the same APK structure differently.
Android Vulnerability Bricks Devices
GhostMap is a serious vulnerability that turns the Android OS against itself. It requires no user interaction and can brick a device, forcing a data-wiping factory reset. Google’s initial dismissal of the flaw as “not reproducible” is a stance that leaves users exposed for what could be a long wait. Until a patch is available, vigilance is paramount. The only reliable defense is to only download applications from trusted sources, as the exploit is delivered through the app’s package file, not its functionality.
‼️ GhostMap Android Flaw Can Trap Phones in Endless Reboot Loops Without Opening an App Details: https://t.co/HW2p99y2gh A new Android bug named GhostMap can leave a phone stuck in a crash loop after a user installs a single crafted app. The app does not need to be opened,… pic.twitter.com/ynheNz4Sr0
