SKETCHUP · CVE-2026-121741 · Package
FIX → 2027.0
A use-after-free in SketchUp's SKP file parsing lets an attacker run code in the SketchUp process when a user opens a malicious file or visits a malicious page. ZDI says it is fixed in SketchUp 2027.0.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that install and open SketchUp models, including SKP files received from clients, vendors or the web, are exposed. The sources do not list affected versions, so check the installed release against the vendor's advisory. Teams that never open SKP files from outside sources can deprioritize this.
Not affected if no-untrusted-skp-files
Who cares design-engineering, desktop, sketchup, windows
Upgrade to 2027.0
Update SketchUp to 2027.0 (per ZDI-26-893).
Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30421.
This page as .md · .json · CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.