PT-2025-44631 · Trimble+1 · Trimble Sketchup 2025+2

Published 2025-10-31 · Updated 2025-10-31 · CVE-2025-60749

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trimble SketchUp desktop version 2025

Description A DLL hijacking issue exists in Trimble SketchUp desktop 2025. This occurs due to a crafted libcef.dll file being used by sketchup webhelper.exe. An attacker could potentially leverage this to execute malicious code within the context of the SketchUp application.

Recommendations Replace the libcef.dll file with a legitimate version.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-60749

Affected Products

Trimble Sketchup 2025

Libcef.Dll

Sketchup Webhelper.Exe

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-60749 · Security Note
• https://t.me/CVEtracker/36307 · Telegram Post
• http://sketchup.com · Note
• https://twitter.com/CVEnew/status/1984277960283795491 · Twitter Post
• https://yawataa.github.io/2025/10/23/CVE-2025-60749 · Note
• https://t.me/cveNotify/141149 · Telegram Post
• https://help.sketchup.com/zh-CN/downloading-sketchup · Note