# CVE-2026-121741: Trimble SketchUp use-after-free in SKP file parsing

Source: https://junglewise.ai/threats/cve-2026-121741-trimble-sketchup-skp-file-parsing-use-after-free-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-121741 · Severity: high · CVSS 7.8 · Published 2026-11-12

Trimble SketchUp is a 3D modeling application used by designers and architects. A use-after-free vulnerability in the SKP file parser allows attackers to execute arbitrary code if a user opens a malicious 3D model file or visits a malicious webpage. This could lead to complete compromise of the user's system and their design files.

Technologies: [Trimble SketchUp](https://junglewise.ai/threats/technologies/sketchup). Vendors: [Trimble](https://junglewise.ai/threats/vendors/trimble).

## Quick answers

**Is CVE-2026-121741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121741 being exploited in the wild.

**How severe is CVE-2026-121741?** High severity, with a CVSS score of 7.8, published 12 November 2026.

**Which products and versions are affected?** Trimble SketchUp.

**Is there a fix for CVE-2026-121741?** Yes: fixed in SketchUp 2027.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121741 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-121741?** Check whether you run Trimble SketchUp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SketchUp 2027.0

## Technical details

A use-after-free flaw exists in SketchUp's SKP file parsing code where the application fails to validate that an object exists before performing operations on it. An attacker crafts a malicious SKP file that triggers this condition; when a user opens the file, arbitrary code executes in the process context. User interaction (opening a file or visiting a webpage) is required to exploit this vulnerability.

## Affected products

- Trimble SketchUp

## Timeline

- 2026-05-21: disclosed: Vulnerability reported to vendor
- 2026-11-06: advisory: Coordinated public release of advisory (ZDI-26-893)
- 2026-11-06: patched: Fixed in SketchUp 2027.0

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-893/](https://www.zerodayinitiative.com/advisories/ZDI-26-893/)

## Related threats

- [Trimble SketchUp XSS in Dynamic Components](https://junglewise.ai/threats/cve-2026-9264-trimble-sketchup-xss-in-dynamic-components)
- [Trimble SketchUp Desktop DLL hijacking in sketchup_webhelper.exe](https://junglewise.ai/threats/cve-2025-60749-trimble-sketchup-desktop-dll-hijacking-in-sketchup-webhelper-exe)