Use‑After‑Free RCE in Trimble SketchUp (CVE‑2026‑121741) Allows Remote Code Execution via Malicious SKP Files
What It Is — A use‑after‑free flaw in the SKP file parser of Trimble SketchUp enables a remote attacker to execute arbitrary code with the privileges of the current user. The vulnerability (CVE‑2026‑121741) has a CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and requires the victim to open a crafted SketchUp file or view a malicious page that triggers the parser. Successful exploitation runs code in the context of the SketchUp process, potentially leading to full system compromise. The issue was reported on 2026‑05‑21, publicly disclosed on 2026‑11‑06, and is fixed in SketchUp 2027.0.
Affected Products — Trimble SketchUp (all versions prior to 2027.0).
Why It Matters for Trust & Control Assurance — The flaw highlights the need for robust secure‑development and vulnerability‑management controls that span third‑party software, ensuring that code‑integrity checks and timely patching are demonstrable evidence of a sound control environment.
Recommended Actions
- Verify your SketchUp version and upgrade immediately to 2027.0 or later.
- Update your software‑inventory and patch‑management records to reflect the remediation.
- Apply application‑whitelisting or execution‑policy controls to block untrusted SKP files.
- Incorporate this CVE into your continuous vulnerability‑monitoring feed and map the remediation to your control framework.
- Review secure‑coding practices for file‑parsing components in any in‑house tools that handle SKP data.
Source: Zero Day Initiative advisory