CVE-2023-50189: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

Trimble SketchUp Viewer contains a use-after-free vulnerability (CVE-2023-50189) that was discovered and reported on July 26, 2023, and publicly disclosed on December 20, 2023. The vulnerability affects the SKP file parsing functionality in SketchUp Viewer and has been assigned a CVSS score of 7.8 (High) (ZDI Advisory).

The vulnerability exists within the parsing of SKP files in SketchUp Viewer. The specific flaw stems from the application's failure to validate the existence of an object before performing operations on it, resulting in a use-after-free condition. This type of vulnerability occurs when the program continues to reference memory after it has been freed, which can lead to arbitrary code execution (ZDI Advisory).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of Trimble SketchUp Viewer. The high CVSS score of 7.8 indicates significant potential impact on the confidentiality, integrity, and availability of the system (ZDI Advisory).

The vulnerability requires user interaction for exploitation - specifically, the target must visit a malicious page or open a malicious file. The attack vector is local (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R) (ZDI Advisory).

The vulnerability has been fixed in SketchUp Viewer Windows version 23.2.101 and Mac version 23.2.102. Users should update to these or later versions to mitigate the risk (ZDI Advisory).