CVE catalog
CVE-2025-66270
kdeconnect: CVE-2025-66270
- Severity
- Medium · CVSS 4.7
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.20% · Oct 27, 2026
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | kdeconnect | sid | 26.08.2-1 | fixed |
| Debian | kdeconnect | forky | 26.08.2-1 | fixed |
| Debian | kdeconnect | trixie | 25.04.2-1+deb13u1 | fixed |
| Debian | kdeconnect | trixie-security | 25.04.2-1+deb13u1 | fixed |
| Debian | kdeconnect | bookworm | 22.12.3-1 | not affected |
| Debian | gnome-shell-extension-gsconnect | sid | 74-1 | fixed |
| Debian | gnome-shell-extension-gsconnect | forky | 74-1 | fixed |
| Debian | gnome-shell-extension-gsconnect | trixie | 62-1+deb13u1 | fixed |
| Debian | gnome-shell-extension-gsconnect | trixie-security | 62-1+deb13u1 | fixed |
| Debian | gnome-shell-extension-gsconnect | bookworm | 54-2 | not affected |
| Ubuntu | kdeconnect | 25.10 | 24.12.3-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.0-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.0-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.1-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.2-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.2-1ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.3-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.07.80-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.07.90-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.0-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.1-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.1-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.1-0ubuntu2.1 | fixed |
| Opensuse | kdeconnect-kde | tumbleweed | 25.11.90-1.1 | fixed |
| Ubuntu | gnome-shell-extension-gsconnect | 25.10 | 62-1 | vulnerable |
| Ubuntu | gnome-shell-extension-gsconnect | 25.10 | 62-1ubuntu1 | vulnerable |
| Ubuntu | gnome-shell-extension-gsconnect | 25.10 | 67-1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 24.12.3-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.0-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.0-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.1-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.2-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.2-1ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.04.3-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.07.80-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.07.90-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.0-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.1-0ubuntu1 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.1-0ubuntu2 | vulnerable |
| Ubuntu | kdeconnect | 25.10 | 25.08.1-0ubuntu2.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | kdeconnect | source | sid | 25.11.80+git20251121.7090b106-1 | not yet assigned | Not reported | Not reported |
| Debian | kdeconnect | source | forky | 25.11.80+git20251121.7090b106-1 | not yet assigned | Not reported | Not reported |
| Debian | kdeconnect | source | trixie | 25.04.2-1+deb13u1 | not yet assigned | Not reported | Not reported |
| Debian | kdeconnect | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | gnome-shell-extension-gsconnect | source | sid | 71-1 | not yet assigned | Not reported | Not reported |
| Debian | gnome-shell-extension-gsconnect | source | forky | 71-1 | not yet assigned | Not reported | Not reported |
| Debian | gnome-shell-extension-gsconnect | source | trixie | 62-1+deb13u1 | not yet assigned | Not reported | Not reported |
| Debian | gnome-shell-extension-gsconnect | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Ubuntu | kdeconnect | deb | 25.10 | 25.08.1-0ubuntu2.1 | Not reported | USN-7905-1 | Not reported |
| Opensuse | kdeconnect-kde | rpm | tumbleweed | 25.11.90-1.1 | Not reported | OPENSUSE-SU-2025:15800-1 | Not reported |
| Ubuntu | kdeconnect | deb | 25.10 | 25.08.1-0ubuntu2.1 | Not reported | UBUNTU-CVE-2025-66270 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [kdeconnect-kde-lang]Unknown
Source package: [kdeconnect-kde]
Details (1)
26.08.0-1.1· noarch · tumbleweedUnknown · Fixed:
25.11.90-1.1Version impact unknown
dsa · kdeconnect-kde · opensuse · tumbleweed
- [kdeconnect-kde]Fixed
Source package: [kdeconnect-kde]
Details (1)
26.08.0-1.1· x86_64 · tumbleweedFixed · Fixed:
25.11.90-1.1dsa · kdeconnect-kde · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [gnome-shell-extension-gsconnect]Not affected
Details (2)
54-2· all · bookwormNot affected
dsa · gnome-shell-extension-gsconnect · debian · bookworm
54-2· all · bookwormNot affected
dsa · gnome-shell-extension-gsconnect · debian · bookworm
- [gnome-shell-extension-gsconnect-browsers]Not affected
Source package: [gnome-shell-extension-gsconnect]
Details (2)
54-2· all · bookwormNot affected
dsa · gnome-shell-extension-gsconnect · debian · bookworm
54-2· all · bookwormNot affected
dsa · gnome-shell-extension-gsconnect · debian · bookworm
- [kdeconnect]Not affected
Details (2)
22.12.3-1· amd64 · bookwormNot affected
dsa · kdeconnect · debian · bookworm
22.12.3-1· arm64 · bookwormNot affected
dsa · kdeconnect · debian · bookworm
- [nautilus-kdeconnect]Not affected
Source package: [kdeconnect]
Details (2)
22.12.3-1· all · bookwormNot affected
dsa · kdeconnect · debian · bookworm
22.12.3-1· all · bookwormNot affected
dsa · kdeconnect · debian · bookworm
[Debian 13 (Trixie)]
Details (4)
62-1+deb13u1· all · trixieFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
62-1+deb13u1· all · trixieFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
62-1+deb13u1· all · trixie-securityFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
62-1+deb13u1· all · trixie-securityFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
Source package: [gnome-shell-extension-gsconnect]
Details (4)
62-1+deb13u1· all · trixieFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
62-1+deb13u1· all · trixieFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
62-1+deb13u1· all · trixie-securityFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
62-1+deb13u1· all · trixie-securityFixed · Fixed:
62-1+deb13u1dsa · gnome-shell-extension-gsconnect · debian · 13
- [kdeconnect]Fixed
Details (4)
25.04.2-1+deb13u1· amd64 · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· arm64 · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· amd64 · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· arm64 · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
- [kdeconnect-libs]Fixed
Source package: [kdeconnect]
Details (4)
25.04.2-1+deb13u1· amd64 · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· arm64 · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· amd64 · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· arm64 · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
- [nautilus-kdeconnect]Fixed
Source package: [kdeconnect]
Details (4)
25.04.2-1+deb13u1· all · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· all · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· all · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· all · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
Source package: [kdeconnect]
Details (4)
25.04.2-1+deb13u1· amd64 · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· arm64 · trixieFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· amd64 · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
25.04.2-1+deb13u1· arm64 · trixie-securityFixed · Fixed:
25.04.2-1+deb13u1dsa · kdeconnect · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15800-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2025-66270]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-66270]
- [https://osv.dev/vulnerability/DSA-6063-1]
- [https://osv.dev/vulnerability/DSA-6066-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-66270]
- [https://osv.dev/vulnerability/USN-7905-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:15800-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-66270]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]