Samsung Email vulnerabilities

9 CVEs affecting Samsung Email, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-21077, published 2025-11-05.

More from Samsung.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-25375, published 2021-04-09. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Using predictable index for attachments in Samsung Email prior to version 6.1.41.0 allows remote attackers to get attachments of another emails when users open the malicious attachment.
• CVE-2021-25376, published 2021-04-09. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. An improper synchronization logic in Samsung Email prior to version 6.1.41.0 can leak messages in certain mailbox in plain text when STARTTLS negotiation is failed.
• CVE-2023-30729, published 2023-09-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including sensitive information.
• CVE-2023-42553, published 2023-11-07. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.
• CVE-2025-20894, published 2025-02-04. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. Improper access control in Samsung Email prior to version 6.1.97.1 allows physical attackers to access data across multiple user profiles.
• CVE-2024-20807, published 2024-01-04. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information.
• CVE-2024-20867, published 2024-05-07. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper privilege management vulnerability in Samsung Email prior to version 6.1.91.14 allows local attackers to access sensitive information.
• CVE-2024-34636, published 2024-08-07. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive information.
• CVE-2025-21077, published 2025-11-05. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege.