CVE-2023-50188: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2023-50188) was discovered in Trimble SketchUp Viewer affecting the SKP file parsing functionality. The vulnerability was disclosed on December 20, 2023, and stems from an uninitialized variable issue. The vulnerability affects installations of Trimble SketchUp Viewer and requires user interaction to exploit, specifically opening a malicious file or visiting a malicious page (Zero Day Initiative).

The vulnerability exists within the parsing of SKP files in Trimble SketchUp Viewer. The specific flaw results from the lack of proper initialization of memory prior to accessing it. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is tracked as ZDI-CAN-20792 (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score of 7.8 indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (Zero Day Initiative).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low (AC:L), requires no privileges (PR:N), but does need user interaction (UI:R) (Zero Day Initiative).

The vulnerability has been fixed in Windows version 23.2.101 and Mac version 23.2.102 of Trimble SketchUp Viewer. Users are advised to update to these versions or later to mitigate the vulnerability (Zero Day Initiative).