Trimble SketchUp Viewer SKP Parsing Use-After-Free RCE (CVE-2024-9725)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: (0Day) Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability 2. Vulnerability ID: ZDI-24-1478, ZDI-CAN-24109 3. CVE ID: CVE-2024-9725 4. CVSS Score: 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 5. Affected Vendor: Trimble 6. Affected Product: SketchUp Viewer 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to execute arbitrary code on affected Trimble SketchUp Viewer installations. - User interaction with a malicious page or malicious file is required to exploit this vulnerability. - The issue lies in the parsing of SKP files, where the object is operated on without verifying its existence, leading to this vulnerability. - Attackers can leverage this vulnerability to execute code in the context of the current process. 8. Additional Details: - 2024-05-01: ZDI reported the vulnerability to the vendor. - 2024-05-01: Vendor confirmed receipt of the report. - 2024-09-06: ZDI requested an update. - 2024-09-23: ZDI requested an update. - 2024-10-08: ZDI notified the vendor of the planned 0-day disclosure. 9. Mitigation: Due to the nature of the vulnerability, the only mitigation strategy is to limit interaction with the application. 10. Disclosure Timeline: - 2024-05-01: Vulnerability reported to vendor. - 2024-11-12: Coordinated public disclosure announced. - 2024-11-12: Disclosure updated. 11. Credit: Mat Powell of Trend Micro Zero Day Initiative

Goal Reached Thanks to every supporter — we hit 100%!

Trimble SketchUp Viewer SKP Parsing Use-After-Free RCE (CVE-2024-9725)