CVE-2024-9712: Trimble SketchUp SKP RCE Vulnerability

CVE-2024-9712 Overview

CVE-2024-9712 is a use-after-free vulnerability in Trimble SketchUp affecting the parsing of SKP files. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires user interaction, specifically opening a crafted SKP file or visiting a malicious page hosting one. The issue was reported through the Zero Day Initiative under identifier ZDI-CAN-23530 and disclosed as ZDI-24-1473. The vulnerability is tracked under CWE-416 (Use After Free).

Critical Impact
Arbitrary code execution in the context of the current user through a crafted SKP file, with no privileges required beyond opening the file.

Affected Products

Trimble SketchUp 23.1.340
Trimble SketchUp desktop application (SKP file parser component)
Environments where users open untrusted SKP files

Discovery Timeline

2024-11-22 - CVE-2024-9712 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9712

Vulnerability Analysis

The vulnerability resides in the SKP file parsing logic of Trimble SketchUp. SketchUp performs operations on an object without first validating that the object still exists in memory. When a crafted SKP file triggers this code path, the application dereferences a freed object, producing a use-after-free condition classified under [CWE-416].

An attacker who controls the freed memory region can steer execution flow. Successful exploitation yields arbitrary code execution in the context of the current process, matching the privileges of the user running SketchUp.

Root Cause

The root cause is missing object lifetime validation before use. The parser performs operations on a pointer that references memory already released to the allocator. This is a classic use-after-free pattern where freed heap chunks can be reclaimed and populated with attacker-controlled data through subsequent allocations triggered during parsing.

Attack Vector

The attack vector is local and requires user interaction. A target must open a malicious SKP file or visit a web page that delivers one. Common delivery channels include email attachments, shared design collaboration platforms, and drive-by download pages hosting weaponized .skp files.

No verified public proof-of-concept exploit code is currently available. Refer to the Zero Day Initiative advisory ZDI-24-1473 for additional technical context.

Detection Methods for CVE-2024-9712

Indicators of Compromise

Unexpected SketchUp process crashes correlated with opening .skp files from untrusted sources
SketchUp spawning child processes such as cmd.exe, powershell.exe, or scripting hosts
.skp files delivered through email, chat, or web downloads from unverified senders
Outbound network connections initiated by the SketchUp process to unfamiliar hosts

Detection Strategies

Monitor process creation events where SketchUp is the parent of shells, scripting engines, or LOLBins
Alert on SketchUp process crashes with heap corruption signatures in Windows Error Reporting
Inspect email and web gateways for .skp attachments and downloads from untrusted origins
Deploy YARA or file-content rules to identify malformed SKP structures used in exploitation attempts

Monitoring Recommendations

Log all .skp file opens through endpoint telemetry and correlate against user reporting
Track file writes to autorun and startup locations following SketchUp execution
Baseline normal SketchUp behavior and alert on deviations such as new child processes or memory injection

How to Mitigate CVE-2024-9712

Immediate Actions Required

Update Trimble SketchUp to the latest available release addressing CVE-2024-9712, per the ZDI-24-1473 advisory
Restrict opening of SKP files to those from trusted sources and internal collaboration channels
Educate designers and engineers about the risk of opening unsolicited .skp files
Inventory endpoints running SketchUp 23.1.340 and prioritize patching

Patch Information

Trimble has coordinated disclosure with the Zero Day Initiative under advisory ZDI-24-1473. Administrators should consult Trimble's official release notes for the fixed SketchUp version and apply the update across affected workstations.

Workarounds

Block .skp file attachments at the email gateway unless the sender is verified
Run SketchUp under a standard user account rather than an administrative account to limit blast radius
Isolate design workstations from sensitive network segments until patching is complete
Use application allowlisting to prevent SketchUp from spawning shells or scripting interpreters

bash

# Example: block .skp attachments at an email gateway (pseudo-configuration)
rule block_untrusted_skp {
    match  attachment.extension == "skp"
    unless sender.domain in trusted_partners
    action quarantine
    notify security-team@example.com
}