CVE-2023-50191: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

CVE-2023-50191 is a Use-After-Free Remote Code Execution vulnerability affecting Trimble SketchUp Viewer. The vulnerability was discovered by Mat Powell of Trend Micro Zero Day Initiative and was publicly disclosed on December 20, 2023. The vulnerability affects the SKP file parsing functionality in SketchUp Viewer installations (ZDI Advisory).

The vulnerability exists within the parsing of SKP files in Trimble SketchUp Viewer. The specific flaw stems from the application's failure to validate the existence of an object prior to performing operations on it, resulting in a Use-After-Free condition. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 HIGH with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of Trimble SketchUp Viewer. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges for execution, though user interaction is required (ZDI Advisory).

The vulnerability has been fixed in SketchUp Viewer Windows version 23.2.101 and Mac version 23.2.102. Users should update to these or later versions to mitigate the risk (ZDI Advisory).