---
id: "TECH-202611-knhkrh"
kind: "technique"
aliases: []
title: "Unpatched Android flaw (GhostMap) lets a malformed app with no permissions put the phone in an endless boot loop, even in Safe Mode (Bitdefender)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Android", "fixed": [], "vendor": "Google", "versions": "Android 17 (5 Aug 2026 patch, Pixel 10) confirmed; others unknown"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-05T09:51:46+00:00"
updated_at: "2026-11-05T09:53:29+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-05T09:51:46+00:00"}]
exploit_sources: []
---

# Unpatched Android flaw (GhostMap) lets a malformed app with no permissions put the phone in an endless boot loop, even in Safe Mode (Bitdefender)

Bitdefender found GhostMap while analysing an Android banking trojan that kept crashing its emulators. Two Android libraries read ZIP compression methods differently, so a malformed APK gets past size checks and is mapped past the end of the file. Any process that reads that entry crashes with SIGBUS. Bitdefender's proof-of-concept app has no code and asks for no permissions, and it does not need to be opened: once it is installed, system_server reads the resource by itself and crashes over and over. The boot loop also blocks Safe Mode. It was tested on a Pixel 10 running Android 17 with the 5 Aug 2026 patch. Google got the report on 20 Aug 2026, closed it as 'Won't Fix (Not Reproducible)' and out of scope, and has released no patch. Other Android versions and makers: unknown. No attacks seen so far, only the proof of concept; the bug was found in banking-trojan code, but whether that trojan uses it on purpose is unknown. No CVE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Android affected range not listed fixed no fixed version listed

## How to check

An Android phone that starts crash-looping (system_server restarting) about a second after an app is installed, and keeps looping in Safe Mode, points to GhostMap. Look out for APKs from outside the Play Store or sent directly to users. Bitdefender has published no app names or hashes in the coverage we have (unknown).

## Fix

No Google patch yet. Install apps only from trusted stores, and on managed fleets block installs from unknown sources. On test or developer phones, keep USB debugging on so the malformed file can be deleted over ADB. Otherwise the only way out is a factory reset, which erases local data, so make sure phones are backed up.

## Timeline

- 2026-11-05T09:51:46+00:00 analyst

## Documents

- [describes] @BleepinComputer: GhostMap Android flaw lets malicious app trigger persistent boot loop
https://t. https://x.com/BleepinComputer/status/2118271787943260518
- [mentions] BleepingComputer: GhostMap Android flaw lets malicious app trigger persistent boot loop https://www.bleepingcomputer.com/news/security/ghostmap-android-flaw-lets-malicious-app-trigger-persistent-boot-loop/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_