Bitdefender finds Android flaw that can trap phones in boot loops

Bitdefender Labs disclosed an unpatched Android flaw nicknamed GhostMap, a parser bug that can trap a smartphone in an endless boot loop after a crafted APK is installed. The researchers found that a 1 KB dropper with a BadPack-style packer causes a crash in a core OS service, propagating during boot and stopping the device from finishing startup. The bug operates even when the app requests no permissions and runs without executable payload. Google has not issued a security patch for this defect, meaning victims would typically require a factory reset to recover data.

In the investigation, Bitdefender observed the issue while analysing an Android banking dropper that had been repackaged to evade static analysis. The team notes that while no confirmed wild exploitation of the boot loop has been observed, the potential exists for attackers to weaponise the flaw. The evidence indicates the persistence of the boot loop can cause system_server to crash and relaunch repeatedly, with Safe Mode providing no relief since the compromised resource can be read before Safe Mode initializes.

The risk is heightened because the attack could be delivered via a routine app update that bypasses store reviews, or by targeting mobile antivirus sandboxes that parse APKs.

The vulnerability stems from a mismatch between two native Android libraries handling APKs: libziparchive and libandroidfw. By mislabeling a resource and declaring an oversized uncompressed length, an attacker triggers an out-of-bounds memory mapping that yields a SIGBUS fault. Bitdefender reported the issue to Google on 20–25 August 2026 with a working proof-of-concept. As of the report, devices running Android 10 through Android 17 appear exposed without an official patch.