ZDI-CAN-23530: ZDI-24-1473: (0Day) Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-9712.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-23530?
ZDI-CAN-23530 is classified as a critical vulnerability due to its ability to execute arbitrary code remotely.
How do I fix ZDI-CAN-23530?
To mitigate ZDI-CAN-23530, users should immediately update to the latest version of Trimble SketchUp provided by the vendor.
What types of attacks can exploit ZDI-CAN-23530?
ZDI-CAN-23530 can be exploited through remote code execution attacks, requiring users to visit a malicious website or open an infected file.
Which versions of Trimble SketchUp are affected by ZDI-CAN-23530?
ZDI-CAN-23530 affects multiple versions of Trimble SketchUp, so all users should verify their installations are up to date.
Is user interaction required for exploiting ZDI-CAN-23530?
Yes, exploiting ZDI-CAN-23530 requires user interaction, as the target must access a specially crafted malicious page or file.