Use‑After‑Free RCE in Trimble SketchUp (CVE‑2026‑121741) Allows Remote Code Execution via Malicious SKP Files

What happened

The Zero Day Initiative disclosed CVE‑2026‑121741 on 6 Nov 2026. The flaw resides in the parsing routine for SketchUp’s native SKP files. Because the parser does not verify an object’s existence before operating on it, a crafted file can trigger a use‑after‑free condition, allowing an attacker who convinces a user to open the file (or view a malicious page that loads it) to run arbitrary code in the SketchUp process. The vulnerability scores 7.8 on the CVSS v3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Trimble released a fix in SketchUp 2027.0.

Why it matters for trust and compliance

• The exploit demonstrates why organizations must maintain evidence of secure‑development practices and a disciplined vulnerability‑management program that can quickly remediate third‑party software flaws.
• Provides concrete evidence for secure‑development and patch‑management controls across the VCF control set.
• Enables continuous monitoring of third‑party software versions against known CVEs to satisfy audit‑readiness requirements.

Who is affected

Recommended actions

1. Upgrade all SketchUp installations to version 2027.0 or later.
2. Update your software‑inventory and patch‑tracking records to capture the remediation date.
3. Apply application‑whitelisting or execution‑policy controls to block untrusted SKP files.
4. Feed CVE‑2026‑121741 into your continuous vulnerability‑monitoring platform and map remediation to the relevant control objectives.
5. Review secure‑coding guidelines for any internal tools that parse SKP files.

Details

CVEs

CVE-2026-121741