New GhostMap Android Vulnerability Can Crash Phones Permanently Without Opening an App or Granting Permissions

Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can cause phones to become stuck in a continuous crash loop immediately after a specially crafted application is installed.

The demonstration app contains no executable code, requests no permissions, and does not need to be launched. To recover, users may need to perform a factory reset, which will erase locally stored data, although this does not indicate permanent hardware damage.

GhostMap Android Vulnerability

According to the supplied November 5 research, testing reproduced the flaw on Android 10 and later, including a Pixel 10 running Android 17 with the August 5, 2026 security patch. The investigation began August 12 after a banking dropper collected from the wild crashed Bitdefender’s analysis emulators during installation.

That original malware sample only caused installation failure. Researchers subsequently developed the persistent crash demonstration themselves and said they had not observed attackers deploying that capability against victims. This distinction separates an accidental malware discovery from confirmed exploitation of the more disruptive technique.

GhostMap stems from inconsistent handling of compression methods and declared uncompressed lengths inside APK archives. Android’s libziparchive validates an entry’s uncompressed size against available file space only when its compression method explicitly identifies it as stored. Unsupported compression values escape that particular check.

Meanwhile, libandroidfw treats every method other than deflate as stored and maps the entry using its declared uncompressed length. An unsupported method therefore crosses the validation gap, allowing a small file to receive a mapping extending beyond its actual contents.

Reading the file-backed mapping beyond the underlying file triggers SIGBUS, terminating whichever process accesses the malformed resource. Researchers documented an 8,408-byte APK mapped across approximately 16 megabytes. The issue causes an invalid read; it does not demonstrate code execution, privilege escalation, or data theft.

This parsing inconsistency echoes BadPack APK manipulation, which exploits differences between Android and analysis tools to obstruct inspection. Unit 42 previously identified nearly 9,200 BadPack samples between June 2023 and June 2024.

When a service inside system_server automatically inspects the malformed resource, the process crashes and restarts. It then reads the same installed resource again, repeating the failure before the interface becomes usable. Rebooting and safe mode did not resolve the issue in researchers’ demonstration.

Unlike the separately reported SMS-triggered Android crashes, GhostMap requires installation of a crafted APK, but no subsequent interaction. Other potential effects include crashing security scanners or uninstall interfaces that load malformed resources. These remain researcher-described scenarios, not confirmed attacks.

Bitdefender reported the findings to Google on August 20 and August 25. According to the disclosure, Google considered the issue outside the scope of a security-update fix and referred it for possible consideration in future versions. No fix was available at publication; unrelated Android security updates should not be assumed to address GhostMap.

Recovery through ADB may be possible only under limited conditions when debugging was previously enabled.

Otherwise, factory reset may be necessary. Bitdefender identifies malformed applications as Android.Riskware.Ghostmap.rA, although third-party scanners cannot independently block installation or remove another app under Android’s security model.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.