GhostMap Android Bug Creates Persistent Crash Loops via Malformed APKs
A novel Android vulnerability, dubbed GhostMap, can cause devices to enter an unrecoverable crash loop by simply installing a specially crafted APK file, even without the app being opened.
Researchers at Bitdefender Labs have uncovered a critical vulnerability in the Android operating system, named GhostMap, that allows for the creation of persistent crash loops on affected devices through the installation of a seemingly innocuous APK file. The exploit is particularly concerning as it requires no user interaction beyond installation, does not necessitate any special permissions, and can render a device unusable until a factory reset is performed.
The vulnerability stems from how Android processes the internal ZIP structure of APK files. Specifically, it exploits a gap in how two different Android libraries handle file entries within the ZIP archive. While one library checks the declared size only for 'stored' compression methods, a second library treats any method other than 'deflated' as 'stored' and maps the file into memory at the declared size. This discrepancy allows for a situation where an APK entry can be mapped to a memory region significantly larger than the actual file content.
When the system attempts to read beyond the legitimate end of the file in this oversized memory mapping, it triggers a SIGBUS error. This is a CPU fault that terminates the process responsible for the read operation. Depending on which file within the APK is malformed, this can lead to different critical processes crashing. A malformed manifest file, for instance, can crash the Android installer, while a malformed resource file can cause the system_server process—which hosts most of Android's core services—to crash repeatedly upon restart, as it attempts to re-read the problematic file.
This repeated crashing of essential system processes results in a continuous loop, often manifesting as a stuck boot animation. The researchers confirmed that even safe mode runs into the same loop, making recovery impossible without a factory reset, which unfortunately erases all user data. The vulnerability has been tested on a Pixel 10 running Android 17 with the August 5, 2026 security patch, and Bitdefender states it is present in the Android Open Source Project (AOSP) from Android 10 up to the latest version.
Bitdefender's discovery originated from a banking dropper malware sample that crashed their analysis emulators. Upon investigation, they found the sample was packed, meaning its internal structure was rewritten to evade reverse engineering. This packing process inadvertently created the malformed ZIP structure that revealed the GhostMap vulnerability. While Bitdefender has not observed this technique being used in the wild, the potential for malicious actors to exploit it is significant.
Google has declined to issue a security update for this vulnerability, classifying it as outside the scope of a security fix. The initial report was closed as 'Won't Fix (Not Reproducible)', and even after a proof-of-concept was provided, Google stated they would pass it to a team for consideration in a future version. This decision leaves devices vulnerable, particularly as the flaw is present in the base Android code.
Unlike previous research on malformed APKs that primarily affected analysis tools or resisted decompilation, GhostMap directly impacts device functionality. Bitdefender's Silviu Stahie highlighted that their exploit triggers an out-of-bounds read and SIGBUS in the caller process, which can be the critical system_server itself. The researchers have not been assigned a CVE ID for this bug, as Google did not accept it through their vulnerability program.
The possibility of such a malformed APK bypassing app store review processes and reaching users remains a concern. However, Bitdefender has refrained from elaborating on how an attacker might circumvent audit controls, citing legal implications related to providing details on exploiting unpatched vulnerabilities. The research underscores the ongoing challenges in securing the complex parsing mechanisms within mobile operating systems.
This new report from Infosecurity Magazine provides further details on the GhostMap vulnerability, including specific technical explanations of how the malformed ZIP entry causes a SIGBUS error by mapping files across unallocated memory. It also elaborates on potential abuse scenarios, such as bricking devices, making apps unremovable, disabling security tools, or delivering the exploit through app updates, and notes that Google has declined to address it as a security fix.