"Reading such an entry causes a SIGBUS ... in whichever process touches the file," Bitdefender's researchers wrote — and that single fault is enough, they show, to turn a modern Android phone into a device that never finishes booting.
How GhostMap corrupts memory mapping
Bitdefender traced the flaw, which it calls "GhostMap," to a mismatch between two Android libraries that interpret ZIP compression methods differently. That divergence lets a malformed APK (the Android package format) bypass size checks and be mapped beyond the actual contents of the file. The operating system ends up mapping a file into an unallocated memory region; when a process tries to read that region it receives a SIGBUS signal and crashes.
In plain terms: a crafted resource inside an otherwise innocuous APK can point the system to read memory that doesn't belong to it. Any process that touches that resource will fault and stop.
How Bitdefender found and demonstrated the bug
The company discovered GhostMap while analyzing an Android banking trojan that repeatedly crashed emulators when the malware tried to read an application resource. To demonstrate impact, researchers built an app that contains no executable code, requests no permissions during installation, and does not need to be launched by the user.
That benign-looking package includes a malformed resource which the core Android service system_server automatically reads after installation. The read triggers the SIGBUS fault and restarts system_server, which then attempts the same read and crashes again, creating an endless reboot loop. On a Pixel 10 running Android 17 with the August 5 security patch, Bitdefender observed the device begin the crash sequence roughly one second after installation; the loop repeated 110 times in normal boot mode and 72 times in safe mode.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadDevice impact and limited recovery options
The crash loop behaves as a persistent denial-of-service: the device repeatedly restarts and, crucially, Bitdefender warns it can prevent users from accessing Safe Mode — the usual troubleshooting path for problematic apps. That leaves two ways reported to stop the cycle. One is a factory reset, which erases all locally stored data. The other is deleting the malformed APK via Android Debug Bridge (ADB), but that requires USB debugging already to be enabled on the device and the removal scripts to execute before the system crashes.
Google's response and the reporting timeline
Bitdefender reported GhostMap to Google on August 20 and received a reply classifying the issue as "Won't Fix (Not Reproducible)" and out of scope. Believing the original report was misclassified, the researchers submitted an extended version on August 25; Google again deemed it out of scope for a security update but reserved it for consideration in a future update. BleepingComputer reached out to Google asking about the fix status and is awaiting a reply.
What this means for end users, security teams, and adversaries
- End users: An app that requests no permissions and need not be launched can render a device unusable; unless a user has USB debugging enabled, the only recovery option short of lost data is a factory reset.
- Security teams and device managers: Third-party security tools may be able to flag or warn about malformed APKs during installation, but Bitdefender notes such tools do not have permission to block installation—placing emphasis on installation-time controls and app vetting.
- Adversaries or exploit developers: GhostMap provides a compact path to persistent denial-of-service using a single, non-executable package that leverages library parsing differences to corrupt memory mapping.
The technical root — ZIP interpretation differences between libraries that allow mapping beyond a file's contents — is concrete and reproduceable in Bitdefender's tests, yet the bug remains outside Google's August security patch scope per the company's exchange with Bitdefender. That leaves a clear practical question: whether and when the mapped-reading logic will be updated to close the gap that permits GhostMap to turn installation into destruction.
