{"id":"TECH-202611-knhkrh","kind":"technique","aliases":[],"related":[],"title":"Unpatched Android flaw (GhostMap) lets a malformed app with no permissions put the phone in an endless boot loop, even in Safe Mode (Bitdefender)","description":null,"summary":"Bitdefender found GhostMap while analysing an Android banking trojan that kept crashing its emulators. Two Android libraries read ZIP compression methods differently, so a malformed APK gets past size checks and is mapped past the end of the file. Any process that reads that entry crashes with SIGBUS. Bitdefender's proof-of-concept app has no code and asks for no permissions, and it does not need to be opened: once it is installed, system_server reads the resource by itself and crashes over and over. The boot loop also blocks Safe Mode. It was tested on a Pixel 10 running Android 17 with the 5 Aug 2026 patch. Google got the report on 20 Aug 2026, closed it as 'Won't Fix (Not Reproducible)' and out of scope, and has released no patch. Other Android versions and makers: unknown. No attacks seen so far, only the proof of concept; the bug was found in banking-trojan code, but whether that trojan uses it on purpose is unknown. No CVE.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Android","fixed":[],"vendor":"Google","versions":"Android 17 (5 Aug 2026 patch, Pixel 10) confirmed; others unknown"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"An Android phone that starts crash-looping (system_server restarting) about a second after an app is installed, and keeps looping in Safe Mode, points to GhostMap. Look out for APKs from outside the Play Store or sent directly to users. Bitdefender has published no app names or hashes in the coverage we have (unknown).","fix":"No Google patch yet. Install apps only from trusted stores, and on managed fleets block installs from unknown sources. On test or developer phones, keep USB debugging on so the malformed file can be deleted over ADB. Otherwise the only way out is a factory reset, which erases local data, so make sure phones are backed up.","status":"open","published_at":null,"first_seen_at":"2026-11-05T09:51:46+00:00","triaged_at":"2026-11-05T09:51:46+00:00","updated_at":"2026-11-05T09:53:29+00:00","category":"runtime","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':26A '10':134B '17':137B '20':149B '2026':142B,151B '5':140B 'also':124B 'analys':38B 'android':2A,29A,40B,49B,136B,170B 'apk':59B 'app':8A,88B 'ask':93B 'attack':176B 'aug':141B,150B 'bank':41B,191B 'banking-trojan':190B 'bitdefend':24A,34B,82B 'block':125B 'boot':18A,122B 'bug':186B 'check':63B 'close':152B 'code':91B,193B 'compress':53B 'concept':87B,184B 'crash':45B,79B,117B 'cve':205B 'differ':55B 'earli':31B 'early-warn':30B 'emul':47B 'end':69B 'endless':17A 'entri':78B 'even':20A 'far':179B 'file':72B 'fix':157B 'flaw':3A 'found':35B,188B 'get':60B 'ghostmap':4A,28A,36B 'googl':144B 'got':145B 'instal':108B 'kept':44B 'knhkrh':27A 'let':5A 'librari':50B 'loop':19A,123B 'maker':173B 'malform':7A,58B 'map':66B 'method':54B 'mode':23A,127B 'need':101B 'open':104B 'past':61B,67B 'patch':143B,168B 'permiss':11A,96B 'phone':14A 'pixel':133B 'process':74B 'proof':85B,182B 'proof-of-concept':84B 'purpos':201B 'put':12A 'read':51B,76B,111B 'releas':166B 'report':147B 'reproduc':159B 'resourc':113B 'run':135B 'safe':22A,126B 'scope':163B 'seen':177B 'server':110B 'sigbus':81B 'size':62B 'system':109B 'tech':25A 'techniqu':33B 'test':130B 'trojan':42B,192B,197B 'two':48B 'unknown':174B,203B 'unpatch':1A 'use':198B 'version':171B 'warn':32B 'whether':195B 'won':155B 'zip':52B","nicknames":["GhostMap"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["android","ghostmap"],"ptokens":["android"],"labels":["earlywarning","medium","runtime","technique"],"campaign_type":"exploitation","first_public_at":"2026-11-05T09:18:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-knhkrh","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T09:51:46+00:00","fetched_at":"2026-11-05T09:51:46+00:00","note":null}],"documents":[{"id":74828,"url":"https://x.com/BleepinComputer/status/2118271787943260518","title":"@BleepinComputer: GhostMap Android flaw lets malicious app trigger persistent boot loop\nhttps://t.","kind":"post","source":"x","publisher":null,"text":"GhostMap Android flaw lets malicious app trigger persistent boot loop\nhttps://t.co/RhSYHSoYiT\n\nhttps://t.co/RhSYHSoYiT\n\nlikes 6 reposts 0","published_at":"2026-11-05T09:18:44+00:00","relation":"describes","confidence":null,"note":null},{"id":74876,"url":"https://www.bleepingcomputer.com/news/security/ghostmap-android-flaw-lets-malicious-app-trigger-persistent-boot-loop/","title":"BleepingComputer: GhostMap Android flaw lets malicious app trigger persistent boot loop","kind":"blog","source":"blog","publisher":null,"text":"GhostMap Android flaw lets malicious app trigger persistent boot loop\n\nAttackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. [...]","published_at":"2026-11-05T09:18:29+00:00","relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}