Resource exhaustion in KDE Connect - CVE-2026-111426
Published: October 30, 2026
Vulnerability identifier: #VU158566
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111426
CWE-ID: CWE-400
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker on the local network to cause a denial of service in KDE Connect.
The vulnerability exists due to uncontrolled resource consumption in KDE Connect's packet handling when processing malformed packets. A remote attacker on the local network can repeatedly send malformed packets to trigger a flood of D-Bus signals and make KDE Connect slow and unresponsive.
When the Plasma desktop and the KDE Connect plasmoid are in use, the disruption can also affect the desktop.
Affected software
KDE Connect
How to mitigate CVE-2026-111426
Install security update from vendor's website.
KDE Connect - update to 26.08.3