← Vulnerability feed

Vulnerability record · CVE-2025-2024 · published 7 March 2025

CVE-2025-2024: Trimble sketchup vulnerability

Trimble · Sketchup

Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25210.

7.8 CVSS 3.0 High EPSS 0.44% · top 64.1% CWE-457 · CWE-457
7.8CVSS 3.0 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Trimble SketchUp SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25210.

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.zerodayinitiative.com/advisories/ZDI-25-111/ Third Party Advisory

Track CVE-2025-2024 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2013-3664Google sketchup memory buffer overflow vulnerabilityTrimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette tab…EPSS 30%9.3CVE-2013-7388Google sketchup memory buffer overflow vulnerabilityHeap-based buffer overflow in paintlib, as used in Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689), allows remote attackers to ex…EPSS 13%7.8CVE-2024-7509Trimble sketchup stack-based buffer overflow vulnerabilityTrimble SketchUp SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exec…EPSS 0.42%7.8CVE-2024-7510Trimble sketchup use after free vulnerabilityTrimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…EPSS 0.47%7.8CVE-2024-9729Trimble sketchup use after free vulnerabilityTrimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar…EPSS 0.30%7.8CVE-2024-9730Trimble sketchup memory buffer overflow vulnerabilityTrimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…EPSS 0.27%7.8CVE-2024-9731Trimble sketchup memory buffer overflow vulnerabilityTrimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…EPSS 0.29%7.8CVE-2024-9712Trimble sketchup use after free vulnerabilityTrimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2025-2024), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.