CVE-2025-66270

MEDIUM4.7EPSS 0.02%

kdeconnect - security update

Published: 12/5/2025Modified: 11/26/2025

Also known as:DSA-6063-1 DSA-6066-1DEBIAN-CVE-2025-66270

Description

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.

Affected packages (4)

Debian/gnome-shell-extension-gsconnectfrom 0, < 62-1+deb13u1
Debian/gnome-shell-extension-gsconnectfrom 0, < 62-1+deb13u1
Debian/kdeconnectfrom 0, < 25.04.2-1+deb13u1
Debian/kdeconnectfrom 0, < 25.04.2-1+deb13u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.7	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-66270