Remote Code Execution Vulnerability in Trimble SketchUp Viewer
CVE-2023-50188

7.8HIGH

Key Information:

Vendor

Trimble

Status
Sketchup Viewer
Vendor
CVE Published:
3 May 2024

What is CVE-2023-50188?

A vulnerability in the Trimble SketchUp Viewer arises from improper handling of SKP files, which may lead to remote code execution. Attackers can exploit this flaw by enticing users to interact with malicious files or visit compromised web pages. The vulnerability stems from a failure to properly initialize memory before it is accessed, allowing attackers to execute arbitrary code within the application context, potentially compromising system integrity.

Affected Version(s)

SketchUp Viewer 22.0.354

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1838/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.