CVE-2025-32899: KDE Connect Android DoS Vulnerability

CVE-2025-32899 Overview

CVE-2025-32899 is a denial-of-service vulnerability in KDE Connect for Android versions before 1.33.0. An attacker on the same local network can craft an invalid discovery packet and broadcast it over UDP. Receiving this packet causes two previously paired devices to unpair, disrupting the trust relationship between them.

The flaw is categorized under [CWE-1250] (Improper Preservation of Consistency Between Independent Representations of Shared State). Exploitation requires only adjacent network access and no authentication or user interaction.

Critical Impact
An attacker on the same broadcast network can forcibly unpair KDE Connect devices, breaking file sharing, notification sync, and remote input trust between paired Android and desktop endpoints.

Affected Products

KDE Connect for Android versions prior to 1.33.0
Any Android device running vulnerable KDE Connect builds paired with a KDE Connect desktop client
Deployments relying on KDE Connect UDP discovery on shared Wi-Fi or LAN segments

Discovery Timeline

2025-12-05 - CVE-2025-32899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32899

Vulnerability Analysis

KDE Connect uses UDP broadcast packets on the local network for peer discovery. Paired devices announce themselves and negotiate encrypted TCP sessions after initial discovery. The Android client before 1.33.0 fails to properly validate the contents of incoming discovery packets before acting on them.

An attacker on the same broadcast domain can send a malformed discovery packet that the client accepts as legitimate control input. Instead of rejecting the invalid packet, the client processes it in a way that removes the existing pairing state between two trusted devices. The result is a targeted denial of service against the KDE Connect trust relationship.

Root Cause

The root cause is inconsistent state handling between the discovery layer and the pairing store. Because the discovery packet parser does not enforce structural validation, an invalid packet reaches code paths that mutate pairing state. This mismatch between the packet's expected representation and the state it can influence maps directly to [CWE-1250].

Attack Vector

Exploitation requires the attacker to be on the same Layer 2 network as at least one of the paired devices. The attacker sends a crafted UDP broadcast packet on the KDE Connect discovery port. No credentials, prior pairing, or user interaction are required. Because UDP broadcasts reach every host on the subnet, a single packet can affect any vulnerable Android client within range. See the KDE Security Advisory 2025-0418 for protocol-level details.

Detection Methods for CVE-2025-32899

Indicators of Compromise

Unexpected unpairing events on KDE Connect Android clients without user action
Malformed UDP broadcast packets destined for the KDE Connect discovery port on the local subnet
Repeated pairing prompts on desktop clients from previously trusted Android devices

Detection Strategies

Monitor KDE Connect application logs on Android and desktop endpoints for unpair events not initiated by users
Deploy network sensors on wireless and LAN segments to flag anomalous UDP broadcast traffic aimed at KDE Connect discovery
Correlate device pairing state changes across paired endpoints to detect simultaneous unpairing consistent with a broadcast attack

Monitoring Recommendations

Track KDE Connect version inventory across managed Android devices and alert on installations below 1.33.0
Log and review UDP broadcast anomalies on guest and corporate Wi-Fi networks where BYOD KDE Connect usage is expected
Alert on repeated re-pairing activity for the same device pairs, which may indicate ongoing exploitation attempts

How to Mitigate CVE-2025-32899

Immediate Actions Required

Update KDE Connect for Android to version 1.33.0 or later from the Google Play Store or F-Droid
Identify all devices running KDE Connect on corporate or sensitive networks and confirm patch status
Restrict KDE Connect usage to trusted network segments until all clients are patched

Patch Information

The issue is fixed in KDE Connect for Android version 1.33.0. Refer to the KDE Security Advisory 2025-0418 and the KDE Connect Official Page for release details and download links.

Workarounds

Disable KDE Connect on Android devices connected to untrusted or public Wi-Fi networks until patched
Segment KDE Connect traffic onto isolated VLANs where broadcast UDP cannot reach untrusted hosts
Block UDP traffic on KDE Connect discovery ports at wireless access points shared with guest users

bash

# Example: block KDE Connect discovery ports on a Linux gateway
# KDE Connect uses UDP/TCP ports 1714-1764 for discovery and pairing
iptables -A FORWARD -p udp --dport 1714:1764 -i wlan-guest -j DROP
iptables -A FORWARD -p tcp --dport 1714:1764 -i wlan-guest -j DROP