CVE-2023-50187: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

A memory corruption vulnerability (CVE-2023-50187) was discovered in Trimble SketchUp Viewer's SKP file parsing functionality. The vulnerability was reported on July 18, 2023, and publicly disclosed on December 20, 2023. This security flaw affects the SketchUp Viewer application on both Windows and Mac platforms (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data during the parsing of SKP files, which can result in a memory corruption condition. The issue has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score reflects the potential for complete compromise of confidentiality, integrity, and availability of the affected system (ZDI Advisory).

The vulnerability requires user interaction for successful exploitation. An attacker would need to convince a target to either visit a malicious webpage or open a specially crafted malicious file (ZDI Advisory).

The vulnerability has been patched in SketchUp Viewer Windows version 23.2.101 and Mac version 23.2.102. Users are advised to update to these or later versions to mitigate the risk (ZDI Advisory).