What is the CVSS score of CVE-2026-9264?

CVE-2026-9264 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Trimble SketchUp are affected by CVE-2026-9264?

Trimble SketchUp 2026 contains a critical vulnerability allowing attackers to execute arbitrary code and steal files from designer workstations via malicious model files.. A patch is available.

How to fix or mitigate CVE-2026-9264?

Within 24 hours, identify all Trimble SketchUp 2026 installations across the organization, verify patch availability through official Trimble channels, and distribute a security advisory to design teams instructing them to avoid opening SKP files from untrusted sources. Within 7 days, deploy the vendor-released patch to all SketchUp 2026 instances and confirm successful installation across the fleet. Within 30 days, validate that all instances are running the patched version and review system and application logs on designer workstations for any suspicious activity dating back 30 days prior to patch deployment.

Trimble SketchUp CVE-2026-9264

EUVD-2026-31386 CRITICAL

Code Injection (CWE-94)

2026-05-22 Bugcrowd

GHSA-gfqf-9c7q-2qmr

XSS RCE Code Injection Sketchup Trimble

9.3

CVSS 3.1 · Vendor: Bugcrowd

Severity by source

Vendor (Bugcrowd) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Attack is delivered via a malicious file the victim must open, so AV:L and UI:R; XSS in the IE11 host escapes to OS command execution (S:C) with full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Bugcrowd).

CVSS VectorVendor: Bugcrowd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:48 vuln.today

CVSS changed

Jul 23, 2026 - 12:23 NVD

9.3 (None) 9.3 (CRITICAL)

Patch available

May 22, 2026 - 02:01 EUVD

CVE Published

May 22, 2026 - 01:04 nvd

UNKNOWN (no severity yet)

CVE Published

May 22, 2026 - 01:04 cve.org

CRITICAL 9.3

DescriptionCVE.org

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.

AnalysisAI

Arbitrary command execution and local file theft in Trimble SketchUp 2026 arises from a cross-site scripting flaw in the Dynamic Components component-options window, which renders untrusted data inside an embedded Internet Explorer 11 engine. An attacker who delivers a maliciously crafted SKP model file can inject script that pivots from XSS to running system commands and reading local files. No public exploit has been identified at time of analysis, and EPSS is very low (0.04%), but the technical impact is rated total and a vendor patch is available.

Technical ContextAI

SketchUp is Trimble's 3D modeling application; its Dynamic Components feature lets model authors embed interactive options and formulas configured through an in-application options window. That window is rendered by a legacy embedded Internet Explorer 11 browser control, so unsanitized attacker-controlled strings inside a .SKP file are treated as active HTML/script. This maps to CWE-94 (code injection): the root cause is that component-option input is not sanitized before being interpreted, allowing script injection that the antiquated IE11 host escalates into OS-level command execution and file access. The affected component is identified by CPE cpe:2.3:a:trimble:sketchup:*, i.e. the desktop SketchUp product line.

RemediationAI

Vendor-released patch: upgrade SketchUp to 2026.1.3 or later, which is the first fixed release per the EUVD affected range and is available from the vendor via the Trimble Trust Center advisory (https://trust.trimble.com/?tcuUid=52252bc0-c196-4b1f-9f13-4e4c9ba247d9). Until patching, treat SKP files from untrusted or external sources as active content: do not open unsolicited models, and where possible avoid opening Dynamic Components from unverified files, since the flaw lives in the component-options rendering path - the trade-off is loss of dynamic-component functionality for those files. Application allowlisting and using EDR to block SketchUp from spawning command interpreters (cmd.exe/PowerShell child processes) reduces RCE impact but may interfere with legitimate plugins/extensions that shell out.