Trimble SketchUp SKP parsing use-after-free allows remote code execution
Original title: ZDI-26-893: Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
ZDI rates CVE-2026-121741 at CVSS 7.8; the target must open a malicious file or visit a malicious page.
ZDI published ZDI-26-893, a use-after-free in Trimble SketchUp SKP file parsing tracked as CVE-2026-121741. Remote attackers can execute arbitrary code on affected installations, but only after a user visits a malicious page or opens a malicious file. ZDI assigned a CVSS rating of 7.8. No fixed version or exploitation status is stated.
- The flaw is tracked as CVE-2026-121741 and ZDI-26-893.
- ZDI assigned a CVSS rating of 7.8.
- Exploitation requires the user to visit a page or open a file.
- The advisory does not name affected or fixed versions.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| Trimble SketchUp | — |
- CVEs
- CVE-2026-121741
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121741 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.