CVE-2025-32901: KDE Connect Android DOS Vulnerability

CVE-2025-32901 Overview

CVE-2025-32901 affects KDE Connect on Android before version 1.33.0. The application processes device identifiers received over broadcast User Datagram Protocol (UDP). Malicious device IDs trigger an unhandled condition that crashes the application. The flaw maps to improper validation of specified type of input [CWE-1287].

An attacker on the same local network can send crafted UDP broadcast packets to disrupt the KDE Connect service on Android devices. Exploitation does not require authentication or user interaction, but it is limited to adjacent network access and only impacts availability.

Critical Impact
Attackers on an adjacent network can crash the KDE Connect Android application remotely by broadcasting malicious device identifiers, breaking device pairing and messaging functionality until the app is restarted.

Affected Products

KDE Connect for Android versions prior to 1.33.0
Android deployments using KDE Connect for device synchronization
Networks where KDE Connect peer discovery over UDP broadcast is enabled

Discovery Timeline

2025-04-18 - KDE Security Advisory 2025-04-18 published
2025-12-05 - CVE-2025-32901 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32901

Vulnerability Analysis

KDE Connect uses UDP broadcast packets for peer discovery on local networks. Each broadcast includes a device identifier string that the receiving client parses before deciding whether to establish a session. The Android client before 1.33.0 fails to validate these identifiers against the expected format or length constraints.

When the client receives an identifier that violates the expected structure, parsing throws an unhandled exception. The exception propagates to the application level, terminating the KDE Connect process. Repeated broadcasts keep the application in a crash loop as it restarts and reprocesses the malicious packets.

The issue is a denial of service only. The vendor advisory describes no code execution, data disclosure, or integrity impact. The vulnerability requires adjacent network access, meaning the attacker must be connected to the same local or wireless network as the target device.

Root Cause

The root cause is improper validation of a specified type of input [CWE-1287]. The identifier handling routine assumes well-formed input from trusted discovery peers. It does not sanitize or bound-check identifier fields extracted from UDP broadcast datagrams, which any host on the broadcast domain can send.

Attack Vector

An attacker on the same Layer 2 broadcast domain crafts a UDP packet containing a malformed device identifier and sends it to the KDE Connect discovery port on the broadcast address. The vulnerable Android client parses the packet, encounters the malformed identifier, and crashes. The attacker needs no credentials, no prior pairing, and no user interaction on the target.

See the KDE Security Advisory 2025-04-18 for the vendor's description of the issue.

Detection Methods for CVE-2025-32901

Indicators of Compromise

Repeated unexpected termination of the KDE Connect Android application on devices connected to shared Wi-Fi networks.
Inbound UDP broadcast traffic to KDE Connect discovery ports (1714-1764) containing non-standard identifier payloads.
Android logcat entries showing unhandled exceptions originating from KDE Connect packet parsing routines.

Detection Strategies

Capture UDP broadcast traffic on wireless segments and inspect KDE Connect discovery packets for malformed or oversized identifier fields.
Monitor Android crash reports and application telemetry for recurring KDE Connect process termination events.
Correlate crash events across multiple devices on the same subnet to identify broadcast-based attacks against the discovery protocol.

Monitoring Recommendations

Enable wireless intrusion detection to flag unusual volumes of UDP broadcasts on ports used by KDE Connect peer discovery.
Collect Android application crash telemetry centrally and alert on clusters of KDE Connect failures tied to a single network segment.
Review guest and corporate Wi-Fi logs for devices generating sustained broadcast traffic consistent with discovery abuse.

How to Mitigate CVE-2025-32901

Immediate Actions Required

Update KDE Connect for Android to version 1.33.0 or later from the Google Play Store or F-Droid.
Inventory managed Android devices for installations of KDE Connect and confirm the installed version meets the fixed baseline.
Restrict use of KDE Connect to trusted networks until all endpoints are patched.

Patch Information

The KDE project resolved the issue in KDE Connect for Android 1.33.0. The fix adds validation of device identifiers received via UDP broadcast so malformed values are rejected without crashing the application. Refer to the KDE Security Advisory 2025-04-18 and the KDE Connect Official Page for release details.

Workarounds

Disable KDE Connect on Android devices when connected to untrusted or public Wi-Fi networks.
Block UDP broadcast traffic on ports 1714-1764 at wireless access points where KDE Connect is not required.
Segment guest wireless networks from corporate wireless networks to limit who can send broadcast packets to managed Android endpoints.

bash

# Example: block KDE Connect discovery ports at a Linux gateway
iptables -A FORWARD -p udp --dport 1714:1764 -j DROP
iptables -A FORWARD -p tcp --dport 1714:1764 -j DROP