CVE-2018-10498

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-24 · updated 2026-06-17
Weakness: CWE-37

Description

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of file:/// URIs. The issue lies in the lack of proper validation of user-supplied data, which can allow for reading arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges. Was ZDI-CAN-5329.

Affected products

Samsung Email: before 5.0.02.16 — fixed in 5.0.02.16

How to fix

Upgrade to a fixed version: Samsung Email 5.0.02.16. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-10498 or the next vulnerability affects your stack