Heap-based Buffer Overflow in Trimble SketchUp Viewer SKP File Parsing
CVE-2024-7508

7.8HIGH

Key Information:

Vendor

Trimble

Status
Sketchup Viewer
Vendor
CVE Published:
22 November 2024

What is CVE-2024-7508?

The vulnerability involves a heap-based buffer overflow in the Trimble SketchUp Viewer during the parsing of SKP files. This flaw is due to inadequate validation of the length of user-supplied data, which can lead to arbitrary code execution on the affected system. To exploit this vulnerability, a user must interact with a malicious web page or open a specially crafted SKP file. Successful exploitation allows an attacker to execute code within the context of the current process, posing significant risks to data integrity and system security. Comprehensive security measures are recommended to mitigate this threat.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1054/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.