KDE Project Security Advisory
=============================

Title:           KDE Connect: Malformed packets can flood D-Bus and freeze the desktop.
Risk rating:     Major
CVE:             CVE-2026-111426
Versions:
    - KDE Connect < 26.08.3
Author:          Albert Vaca Cintora
Date:            30 October 2026

Overview
========

KDE Connect would emit a D-Bus signal every time a malformed packet was received.

Impact
======

An attacker on your local network can send bad packets repeatedly, causing a flood of D-Bus events
and making KDE Connect slow and unresponsive. When using the Plasma desktop and the KDE Connect
plasmoid, this would affect the desktop as well.

Solution
========

Update KDE Connect Android to a non-vulnerable version, or apply this patch:

- https://invent.kde.org/network/kdeconnect-kde/-/commit/71c63c47b51047533f5d9533f27be4375778b21d

Credits
=======

Thanks to Yong-Ho Shin <contact@skew.ch> for reporting this issue.