---
id: "CVE-2026-121741"
page: "https://infrastack.ai/live/CVE-2026-121741"
kind: "vulnerability"
aliases: ["CVE-2026-121741"]
title: "Trimble SketchUp: malicious SKP file lets attackers run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "SketchUp", "fixed": ["2027.0"], "affected": "< 2027.0 (lower bound not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["design-engineering", "desktop", "package", "sketchup", "windows"]
not_affected_if: ["no-untrusted-skp-files"]
published_at: "2026-11-12T03:17:10+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:50:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121741", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-893/", "first_seen_at": "2026-11-12T03:50:37+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-893/"]}]
exploit_sources: []
---

# Trimble SketchUp: malicious SKP file lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-121741 (this .md is for agents)

A use-after-free in SketchUp's SKP file parsing lets an attacker run code in the SketchUp process when a user opens a malicious file or visits a malicious page. ZDI says it is fixed in SketchUp 2027.0.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SketchUp affected < 2027.0 (lower bound not stated) fixed 2027.0

## How to check

In SketchUp open Help > About SketchUp and read the version. Versions older than SketchUp 2027.0 should be treated as exposed; ZDI gives no lower bound. Also check any SketchUp Viewer installs, which are not confirmed as affected.

## Fix

Update SketchUp to 2027.0 (per ZDI-26-893).

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121741
- 2026-11-12T03:50:37+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-893/ — ZDI-26-893 (coordinator advisory, not Trimble's own page) says fixed in SketchUp 2027.0; affected lower bound not stated; Trimble release notes not read, so nothing marked verified. Related older ZDI-25-1198 fixed in 26.0.429 is a different CVE.

## Documents

- [advisory] ZDI-26-893 Trimble SketchUp SKP File Parsing Use-After-Free RCE https://www.zerodayinitiative.com/advisories/ZDI-26-893/

## From the sources

Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30421.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_