KDE Project Security Advisory
=============================

Title:           KDE Connect: Malformed packets can crash the app, causing a denial of service.
Risk rating:     Major
CVE:             CVE-2026-111431
Versions:
    - KDE Connect Android < 1.37.0
Author:          Albert Vaca Cintora
Date:            30 October 2026

Overview
========

It is possible to crash KDE Connect Android by sending a packet that contains a deeply nested JSON.

Impact
======

An attacker on your local network can send packets that will make KDE Connect Android crash.
After Android restarts KDE Connect, the attack can be repeated, causing a denial of service.

Solution
========

Update KDE Connect Android to a non-vulnerable version, or apply this patch:

- https://invent.kde.org/network/kdeconnect-android/-/commit/17778d6d47664e9836a65e6d02414adcf0baff74

Credits
=======

Thanks to @mox_vc (x.com/mox_vc) from Velcore Consulting Inc for reporting this issue.