"We call it GhostMap: the malformed entry causes Android to map the file across memory that was never allocated, and the crash occurs when a process reads from that empty space," Bitdefender wrote, describing a flaw that can force Android phones into an unrecoverable reboot loop.
Bitdefender's discovery and technical breakdown
Security vendor Bitdefender said it found the problem after an Android package (APK) it collected "from the wild" repeatedly crashed emulators in its lab environment. Investigators traced the failure not to malware, but to how Android's ZIP/resource handling code processes two specific ZIP-entry fields: the compression method and the declared uncompressed length.
According to Bitdefender, reading a malformed entry with those fields causes a SIGBUS signal—an operating-system-level stop triggered when a process accesses invalid memory. The vendor described the failure mode as the OS mapping a file "across memory that was never allocated," producing a crash when a process attempts to read from that empty space. Bitdefender named the vulnerability "GhostMap."
Scope: affected versions and persistence across reboots
Bitdefender reported the bug affects Android versions from Android 10 and above. The company warned that the resulting crash loop persists after a normal reboot and continues even in safe mode. Because system services and essential UI components can be the processes that touch the malformed resource, the only recovery Bitdefender reported is a factory reset—which erases locally stored data on the device.
Bitdefender notified Google of the issue on August 20, and, as of the vendor's publication, the company said Google had not issued a fix, concluding the issue was outside the scope of a security patch.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow threat actors could weaponize GhostMap
Bitdefender outlined several concrete abuse scenarios showing how a crafted APK could convert the bug into an offensive capability or leverage for extortion:
- Brick a victim’s phone: embedding a malformed resource that a required system service must read could crash system_server and render the phone unusable, then be used as leverage for extortion.
- Make a malicious app impossible to remove: an app icon or other UI resource could be malformed so that the launcher, Settings app list, and the app’s own info screen all crash when accessed, preventing uninstallation.
- Disable security tools and analysis pipelines: mobile security apps, malware-analysis sandboxes and automated scanners that parse app resources could be crashed by a crafted APK, blocking inspection.
- Mass delivery via app update: a seemingly trusted app could be updated later to include the malformed file, allowing the technique to bypass initial store checks and scale the attack to many victims.
Detection and remediation options
Bitdefender said the most practical device-side defense is to detect the malformed resource before the bug is triggered. The vendor asserted the malformation is visible in a file’s structure and can be identified by static inspection of the APK without installing or executing it. Bitdefender detects the issue as Android.Riskware.Ghostmap.rA.
At the same time, Bitdefender emphasized that, once triggered on-device, the only reported remedy is a factory reset that erases local data. Because the crash persists in safe mode and across reboots, ordinary removal or mitigation steps may not work after exploitation.
What this means for end users, security teams, and app stores
- End users: Devices that encounter a GhostMap-triggering APK can be rendered unusable and require a factory reset, which erases local data. The on-device options to prevent the crash are limited once the malformed resource is processed.
- Security teams and mobile analysts: Tooling that statically inspects APK structure can detect the malformed entry without executing the app; teams running sandboxed dynamic analysis may need safeguards because automated analyzers themselves could be crashed by crafted files.
- App stores and app maintainers: Because a malformed resource can be introduced via a later update, store-side vetting and static file-structure checks become relevant controls to prevent large-scale distribution of crafted APKs.
Bitdefender's report frames GhostMap as a logic and parsing failure in Android's resource handling with practical, high-impact consequences: an exploit that can brick devices, thwart removal, or weaponize analytic tools. With notification to Google on August 20 and no fix published at the time of Bitdefender’s write-up, the immediate defense rests on pre-install static detection and cautious update policies; the longer-term resolution depends on whether the platform maintainer treats the behavior as a patchable security defect.
Original reporting: https://www.infosecurity-magazine.com/news/ghostmap-bug-android-phones-stuck/
