Trimble SketchUp Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability has been identified in Trimble SketchUp, specifically within the SKP file parsing process. This flaw allows remote attackers to execute arbitrary code on affected installations of SketchUp. The vulnerability arises from improper validation of object existence before performing operations, creating an opportunity for code execution in the context of the current process. Exploitation requires user interaction, as the target must open a malicious SKP file or visit a harmful webpage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Users can upgrade to Trimble SketchUp 2026 version 26.0.429 to address this vulnerability.