CVE-2024-9725: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

A use-after-free remote code execution vulnerability (CVE-2024-9725) was discovered in Trimble SketchUp Viewer. The vulnerability was reported to the vendor on May 1, 2024, and was publicly disclosed on November 12, 2024. This security flaw affects the SketchUp Viewer application version 22.0.316.0 and potentially earlier versions (ZDI Advisory, NVD).

The vulnerability exists within the parsing of SKP files and results from the lack of validating the existence of an object prior to performing operations on it. It has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-416 (Use After Free) (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process on affected installations of Trimble SketchUp Viewer. The high CVSS score indicates potential severe impacts on confidentiality, integrity, and availability of the affected system (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges, but does need user interaction (ZDI Advisory).

Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. As of the disclosure date, no official patch has been released by the vendor (ZDI Advisory).