CVE-2025-32898

MediumCVSS 4.7/10Last modified Sep 25, 2026

Description

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before 1.33.0 on Android, KDE Connect before 25.04 on desktop, KDE Connect before 0.5 on iOS, Valent before 1.0.0.alpha.47, and GSConnect before 59.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-331

Affected software

No affected versions have been published.

Timeline

Published: Dec 5, 2025
Last modified: Sep 25, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-328994.3In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically, it is an invalid di CVE-2025-329004.3In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information CVE-2025-329014.3In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.CVE-2025-329067.5A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a m CVE-2025-329075.3A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a ma CVE-2025-329087.5A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path CVE-2025-329095.3A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. The HTTP server m CVE-2025-329106.5A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue may cause the lib CVE-2025-329119.0A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a CVE-2025-329126.5A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client CVE-2025-329137.5A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. CVE-2025-329147.4A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a