CVE-2024-9714: Trimble SketchUp Viewer UAF Vulnerability

CVE-2024-9714 Overview

CVE-2024-9714 is a use-after-free vulnerability in Trimble SketchUp Viewer that enables arbitrary code execution when a user opens a crafted SKP file. The flaw resides in the SKP file parsing logic, where the application performs operations on an object without validating that the object still exists. Attackers must convince a victim to open a malicious file or visit a malicious page hosting the payload. Successful exploitation runs code in the context of the current SketchUp Viewer process. The issue was reported through the Zero Day Initiative and tracked as ZDI-CAN-24097, resulting in advisory ZDI-24-1483.

Critical Impact
A single malicious SKP file can lead to arbitrary code execution on the victim's workstation with the privileges of the SketchUp Viewer process.

Affected Products

Trimble SketchUp Viewer 22.0.316.0
Trimble SketchUp Viewer installations processing untrusted SKP files
Downstream workflows that automatically render or preview SKP content

Discovery Timeline

2024-11-22 - CVE-2024-9714 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9714

Vulnerability Analysis

The vulnerability is a use-after-free condition classified under [CWE-416]. During SKP file parsing, SketchUp Viewer performs operations on an object without first confirming the object still exists in memory. When the referenced object has already been freed, the parser dereferences a dangling pointer. An attacker who controls the SKP contents can influence the state of freed memory and steer execution flow. This yields code execution inside the SketchUp Viewer process.

Root Cause

The root cause is missing object-existence validation in the SKP deserialization routines. The parser assumes lifetime guarantees that the file format does not enforce. A crafted SKP structure triggers premature release of an internal object while a subsequent parsing step still holds a reference. Reuse of the freed allocation allows the attacker to control fields that the parser treats as valid.

Attack Vector

Exploitation requires user interaction. A victim must open a malicious SKP file or visit a page that delivers one through the browser or a file handler association. The attack vector is local because the payload executes only after the file is opened locally, but delivery is typically over the network. Successful exploitation compromises confidentiality, integrity, and availability within the process context.

No public proof-of-concept code or verified exploit samples are available for this issue. Refer to the Zero Day Initiative Advisory ZDI-24-1483 for vendor-coordinated technical detail.

Detection Methods for CVE-2024-9714

Indicators of Compromise

Unexpected child processes spawned by SketchUpViewer.exe such as command shells, PowerShell, or scripting hosts
SKP files arriving from email, chat, or web downloads and being opened outside a controlled review workflow
Crash events or Windows Error Reporting entries referencing the SketchUp Viewer parser modules
Outbound network connections initiated by the SketchUp Viewer process to unknown infrastructure shortly after a file open

Detection Strategies

Monitor process lineage for SketchUp Viewer and alert on any non-standard child process creation
Correlate SKP file open events with subsequent file writes to autorun, startup, or scheduled task locations
Hunt for module load anomalies in the SketchUp Viewer process, including unsigned DLLs and reflectively loaded code
Flag SKP files sourced from external senders or downloaded from uncategorized domains prior to user interaction

Monitoring Recommendations

Enable endpoint telemetry that records process creation, image loads, and file open activity for SketchUp Viewer
Ingest email and web proxy logs to trace SKP file provenance across the delivery chain
Track SketchUp Viewer version inventory and alert when vulnerable builds such as 22.0.316.0 are observed
Retain crash dumps from the viewer process to support forensic analysis of parsing failures

How to Mitigate CVE-2024-9714

Immediate Actions Required

Update Trimble SketchUp Viewer to the latest vendor-supplied build that addresses the SKP parsing flaw
Restrict opening of SKP files to trusted internal sources until patching is complete
Educate users on the risk of opening SKP attachments or downloads from unverified senders
Inventory endpoints running SketchUp Viewer and prioritize remediation on workstations that regularly process external CAD files

Patch Information

Consult the Zero Day Initiative Advisory ZDI-24-1483 for the disclosure record and follow Trimble's official SketchUp release notes for the fixed version. Apply the vendor patch to all installations of SketchUp Viewer identified in asset inventory.

Workarounds

Block inbound SKP attachments at the email gateway when business workflows permit
Open untrusted SKP files only inside an isolated virtual machine or sandboxed environment
Remove default file associations for SKP where the viewer is not required for business operations
Apply application allowlisting to prevent unexpected child processes from being spawned by SketchUp Viewer

bash

# Configuration example
# Windows: remove the SKP file association for users who do not need the viewer
reg delete "HKCR\.skp" /f
reg delete "HKCR\SketchUp.Model\shell\open\command" /f