CVE-2024-9729 is a use-after-free vulnerability classified under CWE-416 affecting Trimble SketchUp Viewer version 22.0.316.0. The flaw exists in the SKP file parsing component, where the software fails to verify the existence of an object before performing operations on it. This leads to a use-after-free condition, which attackers can exploit by crafting malicious SKP files. When a user opens such a file or visits a malicious page that triggers the vulnerability, arbitrary code execution can occur within the context of the SketchUp Viewer process. The vulnerability requires user interaction but no privileges or authentication, making it accessible to remote attackers who can deliver malicious files or links. The CVSS v3.0 score is 7.8, indicating high severity, with impacts on confidentiality, integrity, and availability. The vulnerability was reported by ZDI (ZDI-CAN-24144) and published on November 22, 2024. No patches have been linked yet, and no exploits are known to be in the wild at this time.

The vulnerability allows remote attackers to execute arbitrary code on affected systems, potentially leading to full compromise of the SketchUp Viewer process. This can result in unauthorized access to sensitive data, modification or deletion of files, and disruption of service. Since the application runs with user-level privileges, attackers may leverage this foothold to escalate privileges or move laterally within a network. Organizations relying on SketchUp Viewer for architectural, engineering, or design workflows face risks of intellectual property theft, data corruption, and operational downtime. The requirement for user interaction limits mass exploitation but targeted attacks via phishing or malicious file distribution remain a significant threat vector.

Until an official patch is released, organizations should implement the following mitigations: (1) Restrict the opening of SKP files from untrusted or unknown sources; (2) Educate users about the risks of opening files or clicking links from suspicious emails or websites; (3) Employ endpoint protection solutions capable of detecting anomalous behavior related to SketchUp Viewer; (4) Use application whitelisting to limit execution of unauthorized code; (5) Monitor network and endpoint logs for unusual activity associated with SketchUp Viewer processes; (6) Consider isolating or sandboxing the SketchUp Viewer environment to contain potential exploitation; (7) Once available, promptly apply vendor patches and updates to remediate the vulnerability.