Trimble SketchUp Vulnerability Allows Remote Code Execution via SKP File Parsing Flaw
A use-after-free vulnerability in Trimble SketchUp's SKP file parsing allows remote attackers to execute arbitrary code on affected systems.
Zero Day Initiative (ZDI) has disclosed a critical use-after-free vulnerability affecting Trimble SketchUp, a popular 3D modeling software. Tracked as CVE-2026-121741, this flaw resides within the software's SKP file parsing component.
The vulnerability arises from an insufficient validation of object existence before performing operations on it. This oversight allows a malicious actor to trigger a use-after-free condition, which can then be leveraged to execute arbitrary code within the context of the current process. Successful exploitation would grant the attacker significant control over the affected system.
Exploitation of this vulnerability requires user interaction. Attackers must trick a victim into opening a specially crafted SKP file or visiting a malicious webpage that hosts such a file. This social engineering aspect means that while the vulnerability itself is severe, direct, unprompted exploitation is unlikely. The CVSS score for this vulnerability is rated at 7.8, indicating a high severity.
Trimble has addressed this vulnerability by releasing SketchUp version 2027.0. Users are strongly advised to update to this latest version to mitigate the risk of exploitation. The disclosure timeline indicates that the vulnerability was reported to the vendor on May 21, 2026, and the coordinated public release of the advisory occurred on November 6, 2026, with an update to the advisory on the same day.
The discovery and reporting of this vulnerability are credited to security researcher r1ngz3ro. ZDI's advisories often highlight complex vulnerabilities found in widely used software, providing valuable insights for both defenders and attackers.
This vulnerability underscores the ongoing risks associated with complex file parsing mechanisms in software applications. Attackers continue to target these areas, as flaws can lead to powerful remote code execution capabilities. Users of Trimble SketchUp should remain vigilant and ensure their software is up-to-date to protect against such threats.