Packet Manipulation Vulnerability in KDE Connect for Android
CVE-2025-32899

4.3MEDIUM

Key Information:

Vendor

Kde

Status
Kdeconnect
Vendor
CVE Published:
5 December 2025

What is CVE-2025-32899?

A flaw exists in KDE Connect versions prior to 1.33.0 for Android that allows an attacker to craft a malicious UDP discovery packet. When this packet is broadcasted, it can cause two paired devices to unpair unexpectedly. This vulnerability poses a risk to user connectivity and device management, resulting in disruption of service for users relying on the KDE Connect application for seamless device interaction.

Affected Version(s)

KDEConnect 0 < 1.33.0

References

https://kdeconnect.kde.org
https://kde.org/info/security/advisory-20250418-1.txt

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-32899 : Packet Manipulation Vulnerability in KDE Connect for Android