Bitdefender Labs finds Android flaw that crash-loops phones without opening apps

Bitdefender Labs disclosed an Android flaw on Nov. 5, 2026 that forces Android phones into a reboot loop when a specially crafted APK is installed, even though the app is never opened and the system grants no permission.

The crash occurs as the system reads the APK’s ZIP structure, so the application never needs to execute. A malformed entry gets mapped into memory beyond the file’s real contents, and going past the end triggers SIGBUS, a memory-access error that kills the reading process, and terminates the reader.

The fault traps system_server, which crashes and restarts every few seconds, leaving the phone unable to finish starting. Safe mode does not stop the loop because the system service reads the bad file before safe mode takes effect. Fixing it normally means a factory reset, which wipes all data stored on the device.

Bitdefender classifies the bug as denial-of-service only, meaning it halts processes but does not run code, access data, or elevate privileges. The researcher has not observed any abuse scenarios in the wild. Still, Bitdefender lists potential abuses including disabling a phone, threatening data loss for extortion, blocking uninstallation, and crashing security scanners.

Bitdefender began investigating on Aug. 12, 2026, after a banking dropper collected from the wild crashed its emulators during installation. The dropper was wrapped by a packer that rewrites APK structure, and that rewrite also broke Android’s installer. The first crash came about one second after installation, with 110 cycles during normal boot and 72 in safe mode. Bitdefender converted that failed install into a repeating crash loop targeting a core system service, and says that escalation is its own work and has not been seen used against anyone.

Android recognizes stored and deflated compression, yet the 16-bit ZIP method field can carry other values. libziparchive limits its uncompressed-size check to stored entries, while libandroidfw maps uncompressed size for anything not marked deflated. ZipFileRO bounds mappings to compressed size for non-stored entries, while libandroidfw splits on deflated instead of stored, creating the unsafe gap.

Researchers observed an 8,408-byte APK mapped across roughly 16 MB of memory in one capture. The crash tombstone identifies a mapped read in libandroidfw, with the fault address far beyond the APK’s actual end. Bitdefender security analyst Silviu Stahie said the team went beyond earlier research by causing an out-of-bounds read and SIGBUS in the process that reads the file. “We found a way to exploit that parser gap further and trigger an out-of-bounds (OOB) read and SIGBUS in the caller process.”

The flaw affects Android 10 and above, though Bitdefender tested base Android only and not devices from other manufacturers. Bitdefender reproduced the bug on a Pixel 10 running Android 17 with the Aug. 5, 2026 security patch, using build google/frankel/frankel:17/CP2A.260805.005/15828068:user/release-keys.

Android loads an XML resource or app icon, checks alignment, and if it finds misaligned bytes, it creates a buffer sized to the declared length, overrunning the file and faulting. Because Android reads the manifest first during installation, damaging that file crashes the installer and prevents the app from installing on the device. Malforming the app’s own icon can crash the launcher and Settings screens used to uninstall it, leaving the app installed.

Android reads resources during installation, while the system operates, and when another app inspects them, so the crashing process depends on which file is malformed and who reads it. Security scanners that open the malformed APK crash and cannot flag the app. Bitdefender says a malformed file could be introduced later through an app update.

Google rejected Bitdefender’s Aug. 20, 2026 submission, marking it Won’t Fix (Not Reproducible) and outside its scope. On Aug. 25, 2026, Bitdefender sent a second report with a proof of concept, and Google said it fell outside the scope of a security update fix.

Google sent the report to the responsible team to evaluate it and possibly add it to an upcoming version update. Bitdefender told Google at the end of October 2026 that it planned to publish on November 5, 2026, and Google agreed.

As of Nov. 5, 2026, no public statement from Google about GhostMap has surfaced. BleepingComputer asked Google about the fix status and was still waiting for a reply.

No patch or CVE identifier exists for GhostMap at the time of publication. Bitdefender has no CVE for GhostMap, and Stahie said that if Google had accepted the bug through the vulnerability program, Bitdefender would have received a CVE.

Google addressed a related, weaker defect in Nov. 2016 under CVE-2016-6724, rating it Moderate across Android 4.4.4 through 7.0. Bitdefender says current severity guidelines would rate a persistent factory-reset condition as High rather than Moderate.

Earlier Android parser weaknesses include Master Key from 2013 (CVE-2013-4787), Janus from 2017 (CVE-2017-13156), and BadPack from 2024. Within a single year, Palo Alto’s Unit 42 spotted about 9,200 BadPack samples tied to banking trojans including Anatsa, Cerberus and BianLian.

Cyber Security News points to Konfety malware as an earlier example: it used unsupported compression methods to defeat analysis tools, yet the infected phones kept running and never entered a crash loop. The Apr. 2026 Android bulletin listed a denial-of-service flaw needing no user interaction. A paper from 2014 called Leaving our ZIP undone: How to abuse zip to deliver malware apps looked at APK malformations that evade antivirus unarchiving.

Bitdefender Mobile Security detects the threat as Android.Riskware.Ghostmap.rA and warns the user when a crafted file reaches the device. Third-party security tools can detect the malformed file structure before installation but cannot block installation or remove other apps on their own. Bitdefender advises recognizing the crafted file by its structure before installation, since the app does not need to run.

Users should install apps only from trusted stores and avoid sideloaded APK files until Google acts. PCMag advises downloading only trusted apps and checking the developer’s website and the most negative reviews for risks. Turning on USB debugging may help recovery but carries its own risks.

The best fix would permit only stored and deflate compression methods and treat all others as invalid. Deleting the bad file through ADB works only if USB debugging was already enabled before looping began, and Bitdefender notes ADB-based deletion stops working after the first full kernel reboot.

PCMag says a fix in a future Android version could mean a long wait because Android 18 is unlikely until 2027. PCMag says public disclosure may push Google to patch quickly but could also encourage threat actors to try the technique.