GhostMap: malformed APK traps Android phones in a boot loop

Bitdefender disclosed a denial-of-service flaw it calls GhostMap that lets a malformed Android app trap a phone in a crash loop the moment it's installed — no code execution, no permissions, no launch required. Google declined to ship a security fix, and no CVE has been assigned. Recovery generally means a factory reset.

What GhostMap does

Bitdefender's GhostMap writeup traces the bug to two Android libraries that interpret ZIP compression methods differently. A crafted APK exploits that mismatch to make Android map a file into unallocated memory; reading that region throws a SIGBUS. Because the core system_server process reads a resource from the app right after installation, it crashes, restarts, and crashes again — Bitdefender measured 110 loops in normal boot and 72 in safe mode, beginning about a second after install, as reported by BleepingComputer.

The proof-of-concept app contained no executable code, requested no permissions and was never opened. Installation alone was enough.

What's affected

Bitdefender tested a Pixel 10 on Android 17 (August 5 security patch) and reproduced the crash on Android 10 and later. It did not test every manufacturer, so other vendors' devices are likely affected but unverified. The researchers found the bug while analyzing an Android banking trojan.

Google's response

Bitdefender reported it on 20 August; Google first closed it "Won't Fix (Not Reproducible)." After an extended report with a proof of concept on 25 August, Google called it out of scope for a security update but reserved it for possible inclusion in a future release. Bitdefender says no security update is planned. No in-the-wild abuse has been reported.

Action checklist

1. Install apps only from trusted sources — with no patch forthcoming, the install moment is the only point at which this can be blocked.
2. Keep Google Play Protect enabled; it screens sideloaded APKs at install time.
3. On managed fleets, disable sideloading via MDM and restrict installs to vetted stores.
4. If a device is caught in the loop, recover with a factory reset — or delete the offending file over ADB only if USB debugging was already enabled beforehand.

Context

Install-time APK parsing has produced device-bricking crashes before — a 2017 Samsung system_server crash-loop (CVE-2017-5217) worked on the same principle, that the OS parses untrusted package contents during normal startup. GhostMap's twist is a parser disagreement between two of Android's own libraries, and a vendor that has, so far, decided a reset-only denial of service doesn't meet its security-fix bar. For most users the risk is low and requires installing a hostile app; for kiosk, logistics and other unattended Android deployments, a permissionless brick is a bigger problem.