Bitdefender Labs: GhostMap flaw in Android 10+ lets an 8,408-byte file trigger a reboot loop
Android mishandles ZIP fields: installing a crafted file is enough to put a phone into a reboot loop. Google has issued no patch, and recovery usually requires a factory reset.
Researchers at Bitdefender Labs have described a vulnerability in Android named GhostMap, according to AD HOC NEWS. It allows an attacker to put smartphones from various manufacturers into a persistent reboot loop. Installing a manipulated application file is enough: the app does not need to be opened, run its own code or hold permissions granted by the user ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗.
Cause: a ZIP parsing mismatch
According to Bitdefender Labs, the cause is faulty processing of ZIP fields by the operating system, specifically the compression method and the declared uncompressed file length ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗. Two internal Android libraries interpret these differently. One checks the stated file size only for uncompressed entries, while the other treats every method other than Deflate as uncompressed
ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗.
Because of this discrepancy, a crafted installation file can bypass the system's size checks. In the researchers' tests, a modified file of 8,408 bytes mapped over a memory region of about 16 MB was sufficient. A read past the actual end of the file produces a SIGBUS error, which terminates the process and starts the reboot loop ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗.
Scope, recovery and disclosure
Per the researchers, GhostMap affects all Android versions from Android 10, that is, the operating system generations of the past seven years, across all manufacturers. Once the loop has started, the malicious app cannot be removed by regular means. In most cases recovery requires a factory reset, which erases all unsaved local data. Cleanup without data loss works only if USB debugging was enabled before the crash and cleanup scripts were prepared in advance. External security tools can warn about such programs but cannot block the installation at system level ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗.
Bitdefender Labs found the flaw on 12 August 2026 while analyzing banking-dropper malware. In the researchers' assessment, the author of that malware was unaware of the crash mechanism. The team reported the issue to Google through the Android vulnerability rewards program on 20 August. Google first classed it as not fixable and not reproducible. After an extended report with a proof of concept on 25 August, Google ruled it outside the scope of regular security updates and referred it to the feature development team for future system versions ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗.
At the time of publication there was no patch or security update from Google. The researchers have not observed active exploitation for persistent attacks, and no CVE identifier was assigned. Bitdefender Labs tracks the threat as Android.Riskware.Ghostmap.rA. The company lists possible uses including sabotage, extortion, permanent disabling of security tools and covert delivery through regular app updates. It also notes that publishing the technical details may make it easier for third parties to build working attacks ad-hoc-news.de
AD HOC NEWSad-hoc-news.deOpen source ↗.
