Bitdefender reveals GhostMap Android parsing flaw causing boot loops

On November 5, 2026, Bitdefender Labs demonstrated GhostMap, an Android parsing flaw that traps phones in persistent crash or boot loops after a specially crafted app is installed on Android devices. The research showed that the flaw has not been observed in active exploitation and was presented as a research demonstration rather than an in-the-wild campaign. Bitdefender confirmed the flaw on Android 10 and later releases, including a Pixel 10 handset running Android 17 with the August 5, 2026 security patch, and said no fix was available when it published the research. Fixing the issue may require a factory reset that wipes locally stored data.

The flaw concerns how Android processes information stored inside an APK, the package format for distributing Android applications. Bitdefender found that libziparchive and libandroidfw interpret unusual ZIP compression methods differently. An entry marked with neither stored nor deflated can leave its declared length unchecked, allowing Android to map more memory than the file actually contains. When a process reads past the file-backed bytes, the system ends it with a native SIGBUS fault.

“The operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length,” Bitdefender researchers said. “the crash occurs when a process reads from that empty space,” Bitdefender Labs researchers added. “Reading such an entry causes a SIGBUS,” Bitdefender researchers noted. The ZIP entry method field is a 16-bit number that can hold any value, though Android supports only stored and deflated. Bitdefender’s tombstone showed an APK of a few kilobytes mapped across sixteen megabytes of memory.

An oversized mapping can crash two ways: by reading the entry piece at a time until a read touches empty space, or by loading the whole entry as a single block for an XML resource or app icon. A third library, ZipFileRO, makes the safe choice by using the uncompressed size only for stored entries and the compressed size for the rest, but libandroidfw is the outlier because it splits on deflated rather than stored. Many Android components read an app’s resources at install time, while the system operates, and when another app examines it, so any process that reads an APK runs the same code and the process that reads the malformed entry is the one that crashes.

Bitdefender describes GhostMap as a parser differential vulnerability, which Android has struggled with for more than ten years. In 2014, security researchers published a paper titled “Leaving our ZIP undone: How to abuse zip to deliver malware apps,” which explored malformations applied to APK files to bypass typical AV engine unarchiving. Earlier, Master Key (2013, CVE-2013-4787) allowed an APK with two files of the same name to install malicious code under a valid signature. Janus (2017, CVE-2017-13156) let a single file be a valid APK and a valid DEX at the same time, and BadPack (2024) corrupted ZIP headers so analysis tools failed while phones installed without complaint.

Bitdefender noted that banking trojans such as Anatsa, Cerberus and BianLian used roughly 9,200 samples that Palo Alto’s Unit 42 discovered within one year, showing the kind of packing its sample used.

The company dates its initial discovery to August 12, 2026, when a banking-malware sample collected from the wild crashed its analysis emulators during installation. A packer wrapped the banking dropper that started the investigation, a tool that rewrites APK structure so reverse-engineering tools cannot read it, and the same rewrite broke the Android component parsing the app during installation. The researchers filed an initial report with Google on August 20, 2026, followed by an expanded report containing the persistent crash-loop demonstration on August 25, 2026. Google closed the first report with the status Won’t Fix (Not Reproducible) and called the submission outside the program’s scope.

Google considered the expanded report outside the scope of a security patch and sent it to a feature team for possible inclusion in a future release. “outside the scope of a security update fix,” Google said. By November 5, 2026, no public statement from Google had surfaced, and BleepingComputer reached out to Google asking about the fix status for GhostMap and was still waiting for a reply.

The serious demonstration hit system_server, which hosts key Android services, causing repeated crashes that stopped the phone from reaching a usable interface. system_server crashes and restarts every few seconds during the loop, with no app opened and no screen clue about the responsible app. The crash loop survives a reboot and continues in safe mode, leaving a factory reset as the only escape and erasing all locally stored data. Installing the crafted app can trigger the crash even when the application remains unopened and asks for no permissions. The demonstration app contains no executable code and never needs to run.

On the tested Pixel 10, the first crash came about 1 second after installation, and researchers logged 110 repeated failures in one capture. Bitdefender’s tests showed safe mode did not stop the issue, with one run recording 72 repeated crash cycles. “We have not observed any of these scenarios in the wild,” Bitdefender said. Restarting the phone does not remove the installed package, so startup can trigger the same failure again when a service reads the bad resource.

Removing the bad file through Android Debug Bridge, or ADB, provided only a narrow recovery path. USB debugging needed to be active first, and deletion had to occur between service crashes. After a full kernel reboot, even the ADB path disappears because the crash happens too early during startup. The Android security model prevents one application from removing another on its own.

Bitdefender states its mobile security app flags crafted files when they arrive on a device, whether downloaded or already installed, and alerts the user. Bitdefender presents this as a vendor detection claim, not an operating-system patch or a promise that another security app can block installation. AndroidPure says a store listing cannot guarantee safety because the file might arrive in a later update instead. PCMag Middle East advises checking Settings for system updates regularly, as devices sold by carriers including du, e& and STC might get the fix later if Google has not linked the patch to a security update.

Bitdefender’s recovery approach works only if USB debugging was enabled beforehand, so users should turn it on under Developer options now.

PCMag Middle East reported that Google says a relevant team knows about the issue and may fix it in a future version update, and that Android 18 is unlikely to land until sometime in 2027, which may mean a long wait. Bitdefender argued the bug heads for a possible future Android version rather than a security patch, AndroidPure said. Google patched a weaker version of this defect in the November 2016 bulletin as CVE-2016-6724, rated Moderate and fixed across Android 4.4.4 to 7.0. Bitdefender says current Google severity guidelines describe a factory-reset condition as persistent and rate it High.

PCMag Middle East noted that Bitdefender’s choice to disclose the problem might push Google to close the gap fast, though it could also tempt more threat actors to experiment.