CVE-2024-9716: Trimble SketchUp Viewer RCE Vulnerability

CVE-2024-9716 Overview

CVE-2024-9716 is a use-after-free vulnerability [CWE-416] in Trimble SketchUp Viewer that enables arbitrary code execution through malicious SKP files. The flaw exists within the parsing logic for SketchUp (.skp) files, where the application performs operations on an object without validating its existence. An attacker who convinces a user to open a crafted SKP file or visit a malicious page can execute code in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-24100.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the SketchUp Viewer process, compromising confidentiality, integrity, and availability of the target host.

Affected Products

Trimble SketchUp Viewer 22.0.316.0
Trimble SketchUp Viewer installations processing untrusted SKP files
Workstations running vulnerable SketchUp Viewer builds on Windows

Discovery Timeline

2024-11-22 - CVE-2024-9716 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9716

Vulnerability Analysis

The vulnerability resides in the SKP file parser within Trimble SketchUp Viewer. When the parser processes attacker-controlled structures inside an SKP file, it operates on an object reference without first confirming that the object exists. This condition produces a use-after-free state where freed or uninitialized memory is dereferenced during subsequent operations.

An attacker who controls the layout of the freed allocation can steer execution into attacker-supplied data. The result is arbitrary code execution in the context of the SketchUp Viewer process. Exploitation requires the target user to open a malicious SKP file or visit a page that delivers one, making phishing and drive-by delivery viable initial access techniques.

Root Cause

The root cause is missing object lifetime validation during SKP parsing. The parser assumes that a referenced object is valid at the time of use, but the object can be released or was never initialized. Dereferencing this stale pointer triggers the use-after-free condition tracked as [CWE-416].

Attack Vector

The attack is local and requires user interaction. An attacker crafts an SKP file that manipulates the vulnerable object lifecycle during parsing. Delivery occurs by email attachment, file share, or a web page prompting the user to open the file. Once opened, the parser reaches the vulnerable code path and executes attacker-controlled logic.

No verified public proof-of-concept exists at this time. Refer to the Zero Day Initiative Advisory ZDI-24-1375 for additional technical context.

Detection Methods for CVE-2024-9716

Indicators of Compromise

SketchUp Viewer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after opening an SKP file
Unexpected outbound network connections initiated by the SketchUp Viewer process following file open events
SKP files delivered from external email senders, untrusted web downloads, or removable media
Crash dumps or Windows Error Reporting entries referencing SketchUp Viewer modules during SKP parsing

Detection Strategies

Monitor process creation events where the parent process is SketchUp Viewer and the child process is a scripting or living-off-the-land binary
Alert on SketchUp Viewer processes writing executables, DLLs, or scripts to disk in user-writable paths
Correlate file open telemetry for .skp files with subsequent anomalous process, file, and network activity

Monitoring Recommendations

Log and retain SKP file transfers across email gateways, web proxies, and endpoint file system telemetry
Baseline normal SketchUp Viewer behavior to detect deviations such as memory access violations or unusual module loads
Track patch status of SketchUp Viewer across managed endpoints using vulnerability management tooling

How to Mitigate CVE-2024-9716

Immediate Actions Required

Inventory all endpoints running Trimble SketchUp Viewer and identify hosts on version 22.0.316.0 or earlier vulnerable builds
Apply the vendor-provided update to SketchUp Viewer as soon as it is available for the affected version
Block or quarantine inbound SKP files from untrusted sources at email and web gateways until patching is complete
Educate users to avoid opening SKP files from unknown senders or unverified websites

Patch Information

Trimble has published details through the Zero Day Initiative. Review the Zero Day Initiative Advisory ZDI-24-1375 for vendor remediation guidance and update the SketchUp Viewer installation to the fixed release identified by Trimble.

Workarounds

Restrict opening of SKP files to those originating from trusted, verified sources
Run SketchUp Viewer under a standard user account with least-privilege permissions to limit post-exploitation impact
Associate .skp files with a review or sandbox workflow before allowing execution in the primary viewer
Disable automatic file open behavior in browsers and mail clients for SKP attachments

bash

# Configuration example
# Windows: block .skp attachments at the mail gateway and warn users on download
# Example PowerShell check for installed SketchUp Viewer version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*SketchUp Viewer*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation