CVE-2023-50192: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in Trimble SketchUp Viewer's SKP file parsing functionality. The vulnerability, tracked as CVE-2023-50192, was disclosed on December 20, 2023. This security flaw affects installations of Trimble SketchUp Viewer and requires user interaction to exploit, specifically opening a malicious file or visiting a malicious page (Zero Day Initiative).

The vulnerability stems from the application's failure to validate the existence of an object before performing operations on it during SKP file parsing. This use-after-free condition has been assigned a CVSS v3.0 base score of 7.8 (High) with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is tracked under ZDI-CAN-21786 (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates that successful exploitation could lead to significant impact on the confidentiality, integrity, and availability of the affected system (Zero Day Initiative).

The vulnerability requires user interaction for exploitation, specifically the target must visit a malicious page or open a malicious file. This requirement somewhat mitigates the ease of exploitation, though the attack complexity is considered low once user interaction is achieved (Zero Day Initiative).

The vulnerability has been fixed in Windows version 23.2.101 and Mac version 23.2.102 of Trimble SketchUp Viewer. Users are advised to update to these or later versions to mitigate the risk (Zero Day Initiative).