CVE-2024-9715: Trimble SketchUp Viewer RCE Vulnerability

CVE-2024-9715 Overview

CVE-2024-9715 is a use-after-free vulnerability [CWE-416] in Trimble SketchUp Viewer that allows attackers to execute arbitrary code in the context of the current user. The flaw resides in the parser for SketchUp SKP files and stems from missing validation of an object's existence before subsequent operations reference it. Exploitation requires user interaction: the victim must open a crafted SKP file or visit a malicious page delivering one. The Zero Day Initiative tracked the issue as ZDI-CAN-24098 and published advisory ZDI-24-1376.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the user running SketchUp Viewer, exposing confidentiality, integrity, and availability of the host.

Affected Products

Trimble SketchUp Viewer 22.0.316.0
Trimble SketchUp Viewer desktop builds parsing SKP files
Environments using SketchUp Viewer for 3D model review on Windows workstations

Discovery Timeline

2024-11-22 - CVE-2024-9715 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9715

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered during parsing of Trimble SketchUp SKP model files. SketchUp Viewer allocates objects to represent parsed geometric and metadata structures within the file. During processing, the parser dereferences an object without first confirming that the object still exists. When the referenced memory has been freed or was never validly allocated, subsequent operations act on a dangling pointer.

An attacker who controls the freed allocation's contents can steer execution to attacker-controlled data. This class of memory corruption reliably leads to remote code execution in the context of the current process. Exploitation is local from the perspective of the attack vector because the malicious file must be opened on the target system, but delivery typically occurs through email, chat, or web download.

Root Cause

The root cause is missing existence validation on an object prior to operating on it during SKP file parsing. The parser assumes an object handle remains valid across parsing stages without enforcing lifetime checks, producing the classic use-after-free pattern described in CWE-416.

Attack Vector

An attacker crafts a malicious SKP file that manipulates object allocation and release sequences during parsing. The attacker delivers the file through phishing, a compromised website, or a shared model repository. When the victim opens the file in SketchUp Viewer, the parser reaches the vulnerable code path, dereferences the freed object, and transfers control according to attacker-controlled memory contents.

No authentication is required, and no elevated privileges are needed beyond those of the victim account. See the Zero Day Initiative Advisory ZDI-24-1376 for additional technical context.

Detection Methods for CVE-2024-9715

Indicators of Compromise

Unexpected crashes of SketchUpViewer.exe shortly after opening a .skp file from external sources
Child processes spawned by SketchUp Viewer such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by the SketchUp Viewer process to untrusted hosts
SKP files arriving via email attachments or downloads from unverified domains

Detection Strategies

Monitor for process-tree anomalies where SketchUp Viewer spawns scripting or shell interpreters
Alert on writes to autorun locations or user profile directories by the SketchUp Viewer process
Inspect Windows Error Reporting (WER) telemetry for repeated faults in the SketchUp parser modules
Correlate file open events for .skp files with subsequent suspicious process or network activity

Monitoring Recommendations

Centralize endpoint telemetry from workstations running SketchUp Viewer for behavioral analysis
Retain execution and file-write events from CAD and 3D modeling hosts for at least 90 days
Track user reports of viewer crashes and pair them with EDR forensic timelines

How to Mitigate CVE-2024-9715

Immediate Actions Required

Inventory all installations of Trimble SketchUp Viewer, prioritizing version 22.0.316.0
Restrict opening of SKP files received from external or untrusted sources until patched
Apply application allowlisting to prevent SketchUp Viewer from launching unexpected child processes
Train users handling 3D model files to verify sender identity and file provenance

Patch Information

Refer to Trimble's product security channel and the Zero Day Initiative Advisory ZDI-24-1376 for the current fixed release of SketchUp Viewer. Upgrade all affected endpoints to the vendor-supplied patched version and validate the deployment through software inventory reporting.

Workarounds

Block inbound .skp attachments at the email gateway for high-risk user populations
Open untrusted SKP files only inside isolated virtual machines or sandboxed environments
Remove SketchUp Viewer from systems that do not require 3D model review
Enforce least-privilege user accounts so successful exploitation yields non-administrative access

bash

# Query installed SketchUp Viewer versions across Windows endpoints
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like 'SketchUp Viewer*' } |
  Select-Object Name, Version, InstallDate