Bitdefender Finds Android Bug That Can Trap Phones in Reboot Loop

Bitdefender has disclosed a new Android vulnerability, dubbed GhostMap, which can force devices into a crash loop that only a factory reset can stop. The flaw stems from two mis-handled fields inside a ZIP entry—the compression method and the declared uncompressed length. Reading such an entry triggers a SIGBUS error and causes Android to map memory that wasn’t allocated, ultimately crashing system_server and rendering the device unusable.

The issue persists after reboot and even in safe mode, meaning local data can only be recovered by a full factory reset. The bug is reported to affect all Android versions from Android 10 upwards, and Google has not yet issued a fix, stating the problem lies outside the scope of a standard security patch. Bitdefender first noted the issue on 20 August after observing an APK in the wild that caused emulators to crash in its labs, and described the fault as a flaw in Android itself.

Bitdefender warned that GhostMap could be exploited by threat actors in several ways. Potential scenarios include embedding a malformed resource in an app to crash system components and extort victims, creating an icon that crashes when displayed to prevent uninstallation, disabling security tools by forcing crashes in fungible inspection processes, and delivering the flaw via an app update that bypasses store checks.

The researchers emphasised that the malformation is visible in the file’s structure, so security scanners can detect a crafted file without running it. The Android riskware identifier assigned by the vendor is Android.Riskware.Ghostmap.rA.