Every CVESearch/Get API key

CVE-2013-3664

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to...

9.3 HighPublic exploit

CVE-2013-3664 is a high vulnerability (CVSS 9.3) in Google Sketchup, published July 1, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 29.8%, the 98th percentile. No source names a fixed version.

Severity
9.3 HighCVSS 2.0, NVD
Exploit chance
29.8%EPSS, 98th percentile
Exploitation
None known2 public exploits
Fixed in
No fix listedNo source names one

Description

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

Exploit likelihood

29.8%Down 6.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubdefrancescojp/CVE-2013-3664_BMP2020-01-03
PoC in GitHubdefrancescojp/CVE-2013-3664_MAC2020-01-03

What each source reports

NVD Score used9.3

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

Record
CVE-2013-3664
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

Record
CVE-2013-3664
Updated
2026-11-02
EUVDEUVD-2013-3597No score

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

Record
EUVD-2013-3597
Updated
2026-11-03
GitHub AdvisoriesGHSA-hg63-5gfq-wwmcNo score

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to...

Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture, which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.

Record
GHSA-hg63-5gfq-wwmc
Weakness
CWE-119
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open