GhostMap flaw lets a malicious Android app force a persistent boot loop

Affected devices can only be recovered by a factory reset or by deleting the file over ADB, a route that requires debugging to have been enabled beforehand.

Bitdefender has disclosed a flaw it calls GhostMap that lets a malicious Android app, which needs no permissions and never has to be opened, put a device into a repeating boot loop. The bug comes from two Android libraries that read ZIP compression data differently, so a malformed APK can be mapped past the end of its real contents, and any process that reads that region crashes with a SIGBUS. In Bitdefender's tests on a Pixel 10 running Android 17 with the August 5 security patch, the crash began about a second after install and repeated 110 times in normal mode and 72 in safe mode, blocking the usual recovery path. Users can only clear it by a factory reset or by deleting the file over ADB, which requires debugging to be enabled beforehand. Bitdefender reported the issue to Google on August 20 and again on August 25, but Google marked it as not reproducible and out of scope for a security update, leaving it for a possible future release.