GhostMap Flaw Can Put Android Phones Into Persistent Crash Loop

Overview

• Bitdefender published research on Thursday, November 5, 2026, after tracing the bug to a packed banking dropper that crashed its analysis tools in August.
• The defect arises when one Android library validates a ZIP entry's declared size only for stored files while a second treats non-deflated methods as stored and maps the file at the declared size, enabling an out-of-bounds memory mapping that triggers a SIGBUS fault.
• Installing a specially crafted APK that needs no permissions and contains no executable code can cause the installer or the system_server process to crash repeatedly, producing a boot or install loop that can require a factory reset to fix.
• Bitdefender tested the issue on Android 10 through the latest builds and reproduced the loop on a Pixel 10 running Android 17 with the August 5, 2026 patch, and Google has declined to issue a targeted security update or assign a CVE.
• Key unknowns include whether such malformed APKs can pass app-store review or reach users in practice, and the only current local recoveries are a factory reset or advanced ADB removal if debugging was already enabled.