CVE-2024-9726: 
Trimble SketchUp Viewer vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability (CVE-2024-9726) was discovered in Trimble SketchUp Viewer that allows remote attackers to execute arbitrary code. The vulnerability was reported on May 1, 2024, and publicly disclosed on November 12, 2024. The affected software is Trimble SketchUp Viewer version 22.0.316.0 (NVD, ZDI Advisory).

The vulnerability exists within the parsing of SKP files and results from improper validation of user-supplied data length before copying it to a fixed-length stack-based buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness has been classified as CWE-787 (Out-of-bounds Write) and CWE-121 (Stack-based Buffer Overflow) (NVD, ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process, potentially leading to complete system compromise with the privileges of the affected application (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges but does need local access to the system (ZDI Advisory).

Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. As of the disclosure date, no official patch has been released by the vendor (ZDI Advisory).