CVE-2025-32899

Published: Dec 5, 2025Modified: Jun 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.

Related CWEs

CWE-1250

Improper Preservation of Consistency Between Independent Representations of Shared State

The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.

References (2)

https://kde.org/info/security/advisory-20250418-1.txt

Source: cve@mitre.org

https://kdeconnect.kde.org

Source: cve@mitre.org

Timeline

No history available yet.