CVE-2025-32901

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-05

Last updated on: 2025-12-08

Assigner: MITRE

Description

In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-05

Last Modified

2025-12-08

Generated

2026-07-07

AI Q&A

2025-12-05

EPSS Evaluated

2026-07-06

NVD

CVE-2025-32901

EUVD

EUVD-2025-201335

Affected Vendors & Products

Vendor	Product	Version / Range
kde	kde_connect	1.33.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

This vulnerability in KDE Connect before version 1.33.0 on Android allows malicious device IDs sent via broadcast UDP to cause the application to crash.

Impact Analysis

The vulnerability can cause the KDE Connect application on Android devices to crash when it receives malicious device IDs via broadcast UDP, potentially disrupting normal use of the application.

Detection Guidance

This vulnerability can be detected by monitoring for unusual or malformed UDP broadcast packets containing device IDs sent to KDE Connect on the network. Since KDE Connect uses UDP broadcasts for device discovery, you can use network packet capture tools like tcpdump or Wireshark to filter and inspect UDP traffic on the relevant ports. For example, you can run: tcpdump -i <interface> udp and look for suspicious or malformed device ID payloads that could cause the application to crash. [2]

Mitigation Strategies

Immediate mitigation steps include stopping the use of KDE Connect on untrusted networks such as public Wi-Fi at airports or conferences to avoid exposure to malicious UDP broadcasts. Additionally, update the KDE Connect Android application to version 1.33.0 or later, where this vulnerability is fixed. [2]

Hi! I’m here to help you understand CVE-2025-32901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70