{"id":"CVE-2026-121741","kind":"vulnerability","aliases":["CVE-2026-121741"],"related":[],"title":"Trimble SketchUp: malicious SKP file lets attackers run code","description":"Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30421.","summary":"A use-after-free in SketchUp's SKP file parsing lets an attacker run code in the SketchUp process when a user opens a malicious file or visits a malicious page. ZDI says it is fixed in SketchUp 2027.0.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SketchUp","fixed":["2027.0"],"affected":"< 2027.0 (lower bound not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["design-engineering","desktop","package","sketchup","windows"],"not_affected_if":["no-untrusted-skp-files"],"how_to_check":"In SketchUp open Help > About SketchUp and read the version. Versions older than SketchUp 2027.0 should be treated as exposed; ZDI gives no lower bound. Also check any SketchUp Viewer installs, which are not confirmed as affected.","fix":"Update SketchUp to 2027.0 (per ZDI-26-893).","status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:30+00:00","updated_at":"2026-11-12T03:50:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T03:47:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Trimble SketchUp: malicious SKP file lets attackers run code","impact":"high","summary":"A use-after-free flaw in how SketchUp parses SKP files lets an attacker run arbitrary code in the context of the current process. The attack needs the victim to open a malicious file or visit a malicious page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sketchup","windows","design-engineering"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code in the SketchUp process on the user's machine","analyst_note":"Find the vendor advisory and the fixed SketchUp version (ZDI-CAN-30421); the sources give no affected or fixed versions.","how_to_check":"- Open SketchUp and check its version under Help > About SketchUp, or confirm the installed version from the install folder.\n- Compare the installed version against the affected range from the vendor; the sources do not list affected versions.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-skp-files"],"who_is_affected":"Teams that install and open SketchUp models, including SKP files received from clients, vendors or the web, are exposed. The sources do not list affected versions, so check the installed release against the vendor's advisory. Teams that never open SKP files from outside sources can deprioritize this.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4654,"output_tokens":524,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed SketchUp version (ZDI-CAN-30421); the sources give no affected or fixed versions.","search":"'-121741':12A,15A '-2026':11A,14A '2027.0':63B '30421':164C 'affect':87C 'allow':79C 'arbitrari':84C 'attack':7A,37B,81C,145C 'code':9A,39B,74C,85C,152C 'context':155C 'current':158C 'cve':10A,13A 'design':18B 'design-engin':17B 'desktop':20B 'engin':19B 'execut':75C,83C,151C 'exist':117C,133C 'exploit':97C 'file':5A,33B,50B,67C,113C,123C 'fix':60B 'flaw':116C 'free':28B,72C 'instal':88C 'interact':93C 'issu':125C 'lack':129C 'let':6A,35B 'leverag':147C 'malici':3A,49B,54B,107C,112C 'must':104C 'object':136C,143C 'open':47B,110C 'oper':140C 'packag':21B 'page':55B,108C 'pars':34B,68C,120C 'perform':139C 'prior':137C 'process':43B,159C 'remot':73C,80C 'requir':95C 'result':126C 'run':8A,38B 'say':57B 'sketchup':2A,16A,22B,30B,42B,62B,65C,91C 'skp':4A,32B,66C,122C 'specif':115C 'target':103C 'trimbl':1A,64C,90C 'use':26B,70C 'use-after-fre':25B,69C 'user':46B,92C 'valid':131C 'visit':52B,105C 'vulner':76C,78C,99C,149C 'window':23B 'within':118C 'zdi':56B,162C 'zdi-can':161C","nicknames":[],"mitigations":[],"who_affected":"Teams that install and open SketchUp models, including SKP files received from clients, vendors or the web, are exposed. The sources do not list affected versions, so check the installed release against the vendor's advisory. Teams that never open SKP files from outside sources can deprioritize this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sketchup"],"ptokens":["sketchup"],"labels":["designengineering","desktop","high","package","sketchup","windows"],"campaign_type":null,"search_a":"'-121741':12A,15A '-2026':11A,14A 'attack':7A 'code':9A 'cve':10A,13A 'file':5A 'let':6A 'malici':3A 'run':8A 'sketchup':2A,16A 'skp':4A 'trimbl':1A","search_b":"'2027.0':63B 'attack':37B 'code':39B 'design':18B 'design-engin':17B 'desktop':20B 'engin':19B 'file':33B,50B 'fix':60B 'free':28B 'let':35B 'malici':49B,54B 'open':47B 'packag':21B 'page':55B 'pars':34B 'process':43B 'run':38B 'say':57B 'sketchup':22B,30B,42B,62B 'skp':32B 'use':26B 'use-after-fre':25B 'user':46B 'visit':52B 'window':23B 'zdi':56B","search_c":"'30421':164C 'affect':87C 'allow':79C 'arbitrari':84C 'attack':81C,145C 'code':74C,85C,152C 'context':155C 'current':158C 'execut':75C,83C,151C 'exist':117C,133C 'exploit':97C 'file':67C,113C,123C 'flaw':116C 'free':72C 'instal':88C 'interact':93C 'issu':125C 'lack':129C 'leverag':147C 'malici':107C,112C 'must':104C 'object':136C,143C 'open':110C 'oper':140C 'page':108C 'pars':68C,120C 'perform':139C 'prior':137C 'process':159C 'remot':73C,80C 'requir':95C 'result':126C 'sketchup':65C,91C 'skp':66C,122C 'specif':115C 'target':103C 'trimbl':64C,90C 'use':70C 'use-after-fre':69C 'user':92C 'valid':131C 'visit':105C 'vulner':76C,78C,99C,149C 'within':118C 'zdi':162C 'zdi-can':161C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121741","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121741:3687","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-893/","severity":null,"published_at":"2026-11-12T03:50:37+00:00","modified_at":"2026-11-12T03:50:37+00:00","first_seen_at":"2026-11-12T03:50:37+00:00","fetched_at":"2026-11-12T03:50:37+00:00","note":"ZDI-26-893 (coordinator advisory, not Trimble's own page) says fixed in SketchUp 2027.0; affected lower bound not stated; Trimble release notes not read, so nothing marked verified. Related older ZDI-25-1198 fixed in 26.0.429 is a different CVE.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-893/"]}],"documents":[{"id":131541,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-893/","title":"ZDI-26-893 Trimble SketchUp SKP File Parsing Use-After-Free RCE","kind":"advisory","source":"analyst","publisher":null,"text":"Fixed in SketchUp 2027.0. Reported to vendor 2026-05-21; public 2026-11-06. CVSS 7.8 AV:L/AC:L/PR:N/UI:R. User must open malicious file or visit malicious page.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}