A vulnerability discovered by Romanian security firm Bitdefender enables attackers to render Android devices unusable by deploying a malicious application that needs neither permissions nor execution to cause persistent denial-of-service. The flaw, which the researchers named GhostMap, exploits how Android handles file mapping, forcing the system into a crash loop that persists across reboots.
The vulnerability stems from a discrepancy in how two Android libraries interpret ZIP compression methods. This mismatch allows a specially constructed APK to bypass size validation checks and map a file beyond the actual boundaries of the package contents. When any process attempts to access such a mapped region, the CPU sends a SIGBUS signal that terminates the process immediately.
Bitdefender's researchers uncovered the flaw while investigating an Android banking trojan that repeatedly crashed their test emulators. They built a proof-of-concept application containing no executable code and requesting zero permissions. Upon installation, the app's malformed resource file triggers automatic reads by the core Android service system_server, which crashes and restarts, only to read the same resource and crash again in an endless loop.
Testing and impact
During testing on a Pixel 10 device running Android 17 with the August 5 security patch, the crash cycle began approximately one second after installation. The loop repeated 110 times during normal boot and 72 times when the device entered safe mode. Critically, the boot loop also blocks access to Safe Mode itself, eliminating the standard recovery path users would normally employ to troubleshoot and restore their devices.
Recovery from the attack requires either a factory reset—which destroys all locally stored data—or deletion of the malformed file through ADB. The ADB approach presents additional barriers: it demands that USB debugging already be enabled on the device, and the deletion must occur before the system enters its next crash cycle.
Google's handling
Bitdefender disclosed the issue to Google on August 20. The company responded by marking the report as "Won't Fix (Not Reproducible)" and declaring it outside the scope of security updates. When the researchers submitted additional technical details on August 25 in hopes of correcting the classification, Google maintained its position that the flaw fell outside the scope of security patching, though it noted the issue for potential inclusion in a future release.
According to Bitdefender, Google has maintained awareness of GhostMap since August but has not released a patch. BleepingComputer contacted Google for clarification on the current status of a fix but has not yet received a response.
Mitigation options
Bitdefender notes that the only viable defense occurs at installation time. Third-party security applications may detect and warn users about the threat, but they lack the permissions necessary to prevent installation entirely. This leaves users with limited options to protect themselves before a malicious app reaches their device.