SB2026103047 - Resource exhaustion in KDE Connect

Description

This security bulletin contains information about 1 vulnerability.

1) Resource exhaustion (CVE-ID: CVE-2026-111426)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service in KDE Connect.

The vulnerability exists due to uncontrolled resource consumption in KDE Connect's packet handling when processing malformed packets. A remote attacker on the local network can repeatedly send malformed packets to trigger a flood of D-Bus signals and make KDE Connect slow and unresponsive.

When the Plasma desktop and the KDE Connect plasmoid are in use, the disruption can also affect the desktop.

Remediation

Install update from vendor's website.

References

• https://kde.org/info/security/advisory-20261030-2.txt
• https://invent.kde.org/network/kdeconnect-kde/-/commit/71c63c47b51047533f5d9533f27be4375778b21d