CVE-2024-9713: Trimble SketchUp Pro RCE Vulnerability

CVE-2024-9713 Overview

CVE-2024-9713 is a use-after-free vulnerability in Trimble SketchUp Pro that allows attackers to execute arbitrary code through crafted SKP files. The flaw resides in the SKP file parsing logic and stems from missing validation of object existence before operations are performed on that object [CWE-416]. Exploitation requires user interaction: the target must open a malicious SKP file or visit a page that delivers one. Successful exploitation runs code in the context of the current process. The Zero Day Initiative tracked this issue as ZDI-CAN-23885 before public disclosure.

Critical Impact
Attackers can achieve arbitrary code execution on workstations that open a malicious SKP file, gaining the privileges of the SketchUp Pro user.

Affected Products

Trimble SketchUp Pro 24.0.484
Trimble SketchUp Pro installations processing untrusted SKP files
Windows workstations running vulnerable SketchUp Pro builds

Discovery Timeline

2024-11-22 - CVE-2024-9713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9713

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered while parsing SketchUp SKP files. SketchUp performs operations on an internal object without first confirming that the object still exists. When the referenced memory has already been freed or was never allocated, the parser dereferences a stale pointer. Attackers who control the SKP contents can shape heap state so that the freed allocation is replaced with attacker-controlled data. That data is then interpreted as a valid object, allowing hijack of virtual function calls or other indirect control-flow operations. The end result is arbitrary code execution inside the SketchUp Pro process on the victim workstation.

Root Cause

The root cause is missing object-lifetime validation in the SKP parsing routines. SketchUp Pro reads structured records from the file and dispatches operations against referenced objects without verifying that those objects were successfully constructed or remain valid. This design gap maps directly to [CWE-416: Use After Free].

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted .skp file through email, a shared drive, a web download, or a page that auto-launches the file handler. When the user opens the file in SketchUp Pro, the malicious record triggers the use-after-free during parsing. Code then executes with the privileges of the logged-in user.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Zero Day Initiative Advisory ZDI-24-1474 for the vendor coordination record.

Detection Methods for CVE-2024-9713

Indicators of Compromise

Unexpected crashes of SketchUp.exe immediately after opening an SKP file from an untrusted source
SKP files arriving from external email, chat, or web downloads that trigger the SketchUp file handler
Child processes spawned by SketchUp.exe such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by SketchUp.exe to previously unseen destinations

Detection Strategies

Monitor process-creation events where SketchUp.exe is the parent of shell or scripting interpreters, which is anomalous for a 3D modeling application.
Alert on Windows Error Reporting or crash-dump generation for SketchUp.exe correlated with recent SKP file access.
Inspect endpoint telemetry for memory-corruption exception codes (0xC0000005, 0xC0000374) tied to the SketchUp process.

Monitoring Recommendations

Log SKP file ingress across email gateways, web proxies, and file-sharing platforms and retain the artifacts for retrospective analysis.
Track SketchUp Pro version inventory across the fleet and flag hosts still running 24.0.484 or earlier vulnerable builds.
Enable command-line and image-load auditing on workstations that run CAD software so that post-exploitation activity is captured.

How to Mitigate CVE-2024-9713

Immediate Actions Required

Update Trimble SketchUp Pro to the fixed release identified in the vendor advisory before opening SKP files from external sources.
Restrict opening SKP files to trusted internal sources until patching is complete across the environment.
Block or quarantine inbound SKP attachments at the email gateway pending user awareness communication.
Communicate to designers and engineers that opening SKP files from unknown senders can result in code execution.

Patch Information

Trimble has coordinated remediation through the Zero Day Initiative. Refer to the Zero Day Initiative Advisory ZDI-24-1474 for vendor fix details and apply the version referenced in Trimble's release notes. Verify the installed build after patching by checking the SketchUp Pro Help > About dialog against the fixed version.

Workarounds

Only open SKP files received from verified, trusted sources and reject files from unsolicited senders.
Run SketchUp Pro under a standard user account so that successful exploitation does not yield administrative privileges.
Enable Windows exploit protection (DEP, ASLR, CFG) for SketchUp.exe through the Windows Security app or Group Policy.
Isolate CAD workstations on a segmented VLAN with egress filtering to limit post-exploitation command-and-control options.

bash

# Windows PowerShell: enable exploit protection mitigations for SketchUp.exe
Set-ProcessMitigation -Name "SketchUp.exe" -Enable DEP,EmulateAtlThunks,ForceRelocateImages,BottomUp,HighEntropy,SEHOP,TerminateOnError,CFG