Remote Code Execution Vulnerability in Trimble SketchUp Viewer
CVE-2023-50192

7.8HIGH

Key Information:

Vendor

Trimble

Status
Sketchup Viewer
Vendor
CVE Published:
3 May 2024

What is CVE-2023-50192?

A use-after-free vulnerability exists within the parsing of SKP files in Trimble SketchUp Viewer, enabling remote attackers to exploit this flaw by enticing users to visit a malicious page or open a dangerous file. When an affected installation processes SKP files without proper validation, it may lead to arbitrary code execution in the context of the current process. Users should remain cautious of unknown files and URLs to mitigate the risk associated with this vulnerability.

Affected Version(s)

SketchUp Viewer 22.0.354

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1842/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.