CVE-2024-9719: Trimble SketchUp Viewer Use-After-Free RCE

CVE-2024-9719 Overview

CVE-2024-9719 is a use-after-free vulnerability [CWE-416] in Trimble SketchUp Viewer that allows attackers to execute arbitrary code when a user opens a malicious .skp file. The flaw resides in the SKP file parsing logic, which fails to validate that an object exists before performing operations on it. Successful exploitation runs code in the context of the current user process. The Zero Day Initiative tracks this issue as ZDI-CAN-24103 and published it as ZDI-24-1379.

Critical Impact
Attackers who convince a user to open a crafted SKP file gain arbitrary code execution with the privileges of the SketchUp Viewer process.

Affected Products

Trimble SketchUp Viewer version 22.0.316.0
Windows installations of SketchUp Viewer that parse SKP files
Environments where SketchUp Viewer is the default handler for .skp files

Discovery Timeline

2024-11-22 - CVE-2024-9719 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9719

Vulnerability Analysis

CVE-2024-9719 is a use-after-free condition triggered during SKP file parsing in Trimble SketchUp Viewer. The parser performs operations on an object without first verifying that the object still exists in memory. When the referenced object has been freed, subsequent operations dereference a dangling pointer, corrupting process memory state.

Attackers who control the freed allocation region can reclaim it with attacker-shaped data. This gives them influence over the values used when the stale pointer is dereferenced, which enables control-flow hijacking and arbitrary code execution inside the viewer process.

Exploitation requires user interaction. The victim must open a malicious SKP file or visit a page that delivers one. The attack vector is local, but delivery is trivial through email attachments, shared project files, or drive-by download workflows common in architecture, engineering, and construction environments.

Root Cause

The root cause is a missing existence check on an object referenced during SKP parsing. The code path performs read or write operations against the object without confirming that the underlying allocation is still valid, producing a classic use-after-free primitive as described in CWE-416.

Attack Vector

An attacker crafts a malicious .skp file that triggers the vulnerable parsing path. The attacker delivers the file through email, a shared repository, or a web download. When the target opens the file in a vulnerable SketchUp Viewer build, the use-after-free fires and executes attacker-controlled code in the user's session. See the Zero Day Initiative Advisory ZDI-24-1379 for advisory details.

Detection Methods for CVE-2024-9719

Indicators of Compromise

Unexpected child processes spawned by SketchUpViewer.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or Windows Error Reporting entries referencing SketchUp Viewer modules during SKP file open operations.
Inbound .skp files from untrusted senders, especially when delivered as email attachments or downloaded from unverified sources.

Detection Strategies

Alert on process-lineage anomalies where SketchUp Viewer launches script interpreters, shells, or LOLBins.
Monitor for outbound network connections initiated by SketchUpViewer.exe, which does not typically require internet access for local file rendering.
Inspect endpoint telemetry for memory-corruption exception codes such as 0xC0000005 associated with the SketchUp Viewer process.

Monitoring Recommendations

Track .skp file downloads and email attachments at the mail gateway and web proxy.
Enable Windows Defender Exploit Guard or equivalent to log block events on the SketchUp Viewer process.
Correlate file-open events with subsequent process creation to identify malicious document workflows.

How to Mitigate CVE-2024-9719

Immediate Actions Required

Update Trimble SketchUp Viewer to a version later than 22.0.316.0 that addresses this issue.
Restrict opening of SKP files to those from trusted internal sources until patches are deployed across the fleet.
Educate users in design and engineering teams about the risk of opening unsolicited .skp attachments.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1379 for the current vendor remediation status. Administrators should consult Trimble's official release notes and upgrade SketchUp Viewer to the latest available build.

Workarounds

Remove SketchUp Viewer as the default handler for .skp files on systems that do not require it.
Apply application allowlisting to prevent SketchUp Viewer from launching child processes such as shells or scripting engines.
Open untrusted SKP files only inside isolated virtual machines or sandboxed containers with no network access.

bash

# Configuration example: block child process creation from SketchUp Viewer via Windows Defender Attack Surface Reduction
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled