CVE-2025-2024: Trimble SketchUp SKP File RCE Vulnerability

CVE-2025-2024 Overview

CVE-2025-2024 is a remote code execution vulnerability in Trimble SketchUp caused by improper initialization of memory during SKP file parsing [CWE-457]. An attacker can craft a malicious SKP file that, when opened by a victim, allows arbitrary code execution in the context of the SketchUp process. The flaw was reported through the Zero Day Initiative as ZDI-CAN-25210. Exploitation requires user interaction, such as opening a malicious file or visiting a page that delivers one.

Critical Impact
Successful exploitation grants attackers code execution with the privileges of the user running SketchUp, enabling local compromise from a single malicious file.

Affected Products

Trimble SketchUp (all versions prior to the vendor fix referenced in ZDI-25-111)
Desktop installations parsing untrusted .skp files
Workstations where users open SKP files from email, web, or shared storage

Discovery Timeline

2025-03-07 - CVE-2025-2024 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2024

Vulnerability Analysis

The vulnerability resides in the SKP file parser used by Trimble SketchUp. During parsing, the application accesses memory before it has been properly initialized, classified under [CWE-457] Use of Uninitialized Variable. An attacker who controls the contents of an SKP file can influence the values read from this uninitialized memory region.

By shaping process state before parsing, an attacker can place attacker-controlled data where the parser expects valid object metadata or pointers. Dereferencing that data lets the attacker redirect program flow and achieve arbitrary code execution within the SketchUp process. The Zero Day Initiative advisory ZDI-25-111 confirms code execution in the context of the current user.

Root Cause

The parser fails to zero or validate a memory region prior to use. Subsequent read operations consume residual or attacker-influenced bytes as if they were trusted structures. This breaks the assumption that local variables or heap allocations contain known values before access.

Attack Vector

Exploitation requires the victim to open a malicious .skp file or visit a page that delivers one. The CVSS vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects local attack vector with required user interaction. Typical delivery channels include phishing attachments, shared design repositories, and trojanized model libraries.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Zero Day Initiative Advisory ZDI-25-111 for additional technical context.

Detection Methods for CVE-2025-2024

Indicators of Compromise

Unexpected child processes spawned by SketchUp.exe, particularly command interpreters such as cmd.exe, powershell.exe, or wscript.exe
Crash dumps or Windows Error Reporting events referencing SketchUp modules immediately after opening a .skp file
.skp files arriving from untrusted sources such as email attachments, external file shares, or web downloads
Outbound network connections initiated by the SketchUp process to unrecognized hosts shortly after file open

Detection Strategies

Hunt for process lineage where SketchUp.exe is the parent of scripting or living-off-the-land binaries
Inspect file write activity by SketchUp into directories such as %APPDATA%, %TEMP%, or startup folders
Correlate SKP file opens with subsequent module loads of non-SketchUp DLLs from user-writable paths

Monitoring Recommendations

Enable endpoint telemetry for process creation, image load, and file write events on workstations running SketchUp
Forward SketchUp application crash events and Windows Defender Application Control logs to a central SIEM
Track inbound .skp files at the email and web proxy layers and tag for retrospective hunting

How to Mitigate CVE-2025-2024

Immediate Actions Required

Update Trimble SketchUp to the version identified in the vendor advisory referenced by ZDI-25-111
Restrict opening of .skp files to those originating from trusted, verified sources
Educate users on the risk of opening SketchUp models received via email or downloaded from untrusted websites
Inventory endpoints running SketchUp to confirm patch coverage across the environment

Patch Information

Trimble has issued a fixed version of SketchUp addressing the uninitialized variable condition. Apply the update referenced in the Zero Day Initiative advisory ZDI-25-111. Verify installed versions through software inventory tooling and prioritize systems used by users who regularly handle externally sourced models.

Workarounds

Block inbound .skp attachments at email gateways until patching is complete
Use application allowlisting to prevent SketchUp from spawning script interpreters or shells
Run SketchUp under a standard user account to limit the impact of successful exploitation
Open untrusted SKP files only inside an isolated virtual machine or sandbox

bash

# Example: block .skp attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block SKP Attachments" \
  -AttachmentExtensionMatchesWords "skp" \
  -RejectMessageReasonText "SKP files are blocked pending CVE-2025-2024 remediation."