CVE-2023-50190: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

Trimble SketchUp Viewer contains a vulnerability in SKP file parsing that was disclosed on December 20, 2023. The vulnerability, tracked as CVE-2023-50190, affects the SketchUp Viewer application and has been assigned a CVSS score of 7.8 (ZDI Advisory).

The vulnerability exists within the parsing of SKP files and stems from improper validation of user-supplied data. This can result in an out-of-bounds write condition, where data can be written past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of Trimble SketchUp Viewer. However, user interaction is required as the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requires no privileges, but does need user interaction (ZDI Advisory).

The vulnerability has been fixed in Windows version 23.2.101 and Mac version 23.2.102 of SketchUp Viewer (ZDI Advisory).