Remote Code Execution Vulnerability in Trimble SketchUp Viewer SKP File Handling
CVE-2024-9721

7.8HIGH

Key Information:

Vendor

Trimble

Status
Sketchup Viewer
Vendor
CVE Published:
22 November 2024

What is CVE-2024-9721?

A vulnerability exists within the Trimble SketchUp Viewer related to the parsing of SKP files. This flaw arises from the failure to validate the existence of an object before executing operations on it. If successfully exploited, this vulnerability enables remote attackers to execute arbitrary code within the context of the application, contingent upon user interaction, which includes visiting a malicious webpage or opening a compromised SKP file. Awareness and prompt action to secure affected installations are essential to mitigate the risks associated with this vulnerability.

Affected Version(s)

SketchUp Viewer 22.0.316.0

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1482/
x_research-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.