KDE Connect Android Denial-of-Service Vulnerability via Malicious Device IDs

A denial-of-service vulnerability has been identified in KDE Connect for Android, affecting versions prior to 1.33.0. The issue arises when malicious device IDs are sent over broadcast UDP. Because UDP lacks authentication, an attacker can introduce an invalid device ID that causes the application to crash while attempting to process and save the information.

Impact

Exploiting this vulnerability can lead to a crash of the KDE Connect application, causing a denial-of-service condition on the device.

Remediation

Users are advised to update KDE Connect for Android to version 1.33.0 or later.