CVE-2023-50194: Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50194?
CVE-2023-50194 has a critical severity rating as it allows remote code execution.
How does CVE-2023-50194 work?
CVE-2023-50194 enables remote attackers to execute arbitrary code by convincing the user to visit a malicious page or open a malicious file.
What versions of Trimble SketchUp Viewer are affected by CVE-2023-50194?
CVE-2023-50194 affects all affected installations of Trimble SketchUp Viewer without specifying particular versions.
What is the recommended action to mitigate CVE-2023-50194?
To mitigate CVE-2023-50194, users should avoid opening suspicious files or visiting untrusted links.
Are there any patches available for CVE-2023-50194?
As of now, there are no specific patches released for CVE-2023-50194, but users should keep an eye on Trimble's updates.