CVE-2025-32900

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to...

4.3 MediumFix available

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP is used. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.12%Up 0.1 points since Dec 5, 2025

What each source reports

CVE List Score used 4.3

Record: CVE-2025-32900
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-348
Updated: 2026-11-02

EUVDEUVD-2025-201362 4.3

Record: EUVD-2025-201362
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gxgp-vx99-mxcw 4.3

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to...

Record: GHSA-gxgp-vx99-mxcw
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-348
Updated: 2026-11-02

NVD 4.3

Record: CVE-2025-32900
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-348
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-32900 4.3

Record: DEBIAN-CVE-2025-32900
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-32900 4.3

Record: UBUNTU-CVE-2025-32900
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Affected products

kde connect information-exchange protocol

Affected packages

Affected packages
Package	Affected	Fixed
`gnome-shell-extension-gsconnect` Debian:12	All versions, plus listed versions 54-255-155-255-355-4 Show 14 moreShow less 56-157-157-257-358-158-258-362-167-167-271-172-173-174-1	None known
`gnome-shell-extension-gsconnect` Debian:13	before 62-1	62-1
`gnome-shell-extension-gsconnect` Debian:14	before 62-1	62-1
`kdeconnect` Debian:12	All versions, plus listed versions 22.12.3-123.08.2-123.08.5-124.08.2-124.08.3-1 Show 12 moreShow less 24.08.3-224.12.0-125.04.0+git20250504.28fb9142-125.04.0-125.04.2-125.08.1-125.11.80+git20251121.7090b106-125.12.3-126.04.0-126.04.3-126.04.3-226.08.2-1	None known
`kdeconnect` Debian:13	before 25.04.0-1	25.04.0-1
`kdeconnect` Debian:14	before 25.04.0-1	25.04.0-1
`kdeconnect` Ubuntu:16.04:LTS	All versions, plus listed versions 0.8-0ubuntu5	None known
`kdeconnect` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.3-0ubuntu21.2.1-0ubuntu11.2.1-0ubuntu21.3.0-0ubuntu11.3.1-0ubuntu0.11.3.3-0ubuntu0.18.04.1	None known
`kdeconnect` Ubuntu:20.04:LTS	All versions, plus listed versions 1.3.5-0ubuntu11.4-0ubuntu11.4-0ubuntu21.4-0ubuntu31.4-0ubuntu41.4-0ubuntu5	None known
`kdeconnect` Ubuntu:22.04:LTS	All versions, plus listed versions 21.08.1-0ubuntu121.08.1-0ubuntu221.08.3-0ubuntu121.08.3-1ubuntu121.11.80-0ubuntu1 Show 6 moreShow less 21.11.90-0ubuntu121.11.90-0ubuntu221.12.0-0ubuntu121.12.1-0ubuntu121.12.2-0ubuntu121.12.3-0ubuntu1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`kdeconnect` Ubuntu:24.04:LTS	All versions, plus listed versions 23.08.1-0ubuntu123.08.2-0ubuntu123.08.3-0ubuntu123.08.4-0ubuntu123.08.5-0ubuntu123.08.5-0ubuntu423.08.5-0ubuntu5	None known
`kdeconnect` Ubuntu:25.10	All versions, plus listed versions 24.12.3-0ubuntu225.04.0-0ubuntu125.04.0-0ubuntu225.04.1-0ubuntu125.04.2-0ubuntu2 Show 8 moreShow less 25.04.2-1ubuntu125.04.3-0ubuntu125.07.80-0ubuntu125.07.90-0ubuntu125.08.0-0ubuntu125.08.1-0ubuntu125.08.1-0ubuntu225.08.1-0ubuntu2.1	None known
`kdeconnect` Ubuntu:26.10	All versions, plus listed versions 25.12.3-0ubuntu126.04.0-1ubuntu126.04.1-0ubuntu126.04.2-0ubuntu126.04.3-0ubuntu1 Show 5 moreShow less 26.04.3-1ubuntu126.07.90-0ubuntu126.08.0-0ubuntu126.08.0-0ubuntu226.08.1-0ubuntu1	None known
`kdeconnect` Ubuntu:26.04:LTS	All versions, plus listed versions 25.08.1-0ubuntu225.08.2-0ubuntu225.08.3-0ubuntu125.11.80-0ubuntu125.11.80-0ubuntu2 Show 7 moreShow less 25.11.90-0ubuntu125.12.0-0ubuntu125.12.1-0ubuntu125.12.1-0ubuntu225.12.2-0ubuntu125.12.2-0ubuntu325.12.3-0ubuntu1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-32900 is a medium vulnerability (CVSS 4.3) in Kde Connect Information-exchange Protocol, published December 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in gnome-shell-extension-gsconnect 62-1.