Remote Code Execution Vulnerability in Trimble SketchUp Pro SKP File Parsing
CVE-2024-9713

7.8HIGH

Key Information:

Vendor

Trimble

Status
Sketchup
Vendor
CVE Published:
22 November 2024

What is CVE-2024-9713?

A vulnerability has been identified in Trimble SketchUp Pro related to the parsing of SKP files. When a user opens a malicious SKP file or visits a compromised webpage, a use-after-free flaw can be exploited. This occurs due to improper validation of object existence before operations are performed on them. As a result, an attacker may execute arbitrary code with the same privileges as the affected user, potentially compromising system integrity and security. Proper safeguarding measures are essential for users of Trimble SketchUp Pro.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1474/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.