Quick answers
- Is CVE-2026-121741 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121741 being exploited in the wild.
- How severe is CVE-2026-121741?
- High severity, with a CVSS score of 7.8, published 12 November 2026.
- Which products and versions are affected?
- Trimble SketchUp.
- Is there a fix for CVE-2026-121741?
- Yes: fixed in SketchUp 2027.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121741 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-121741?
- Check whether you run Trimble SketchUp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: SketchUp 2027.0
Technical details
A use-after-free flaw exists in SketchUp's SKP file parsing code where the application fails to validate that an object exists before performing operations on it. An attacker crafts a malicious SKP file that triggers this condition; when a user opens the file, arbitrary code executes in the process context. User interaction (opening a file or visiting a webpage) is required to exploit this vulnerability.
Affected products
- Trimble SketchUp
Timeline
- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-11-06: advisory: Coordinated public release of advisory (ZDI-26-893)
- 2026-11-06: patched: Fixed in SketchUp 2027.0