Kde Kdeconnect vulnerabilities

3 CVEs affecting Kde Kdeconnect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-32901, published 2025-12-05.

More from Kde.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-26164, published 2020-10-07. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a…
• CVE-2025-32901, published 2025-12-05. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
• CVE-2025-32899, published 2025-12-05. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid discovery packet sent over broadcast UDP.