# \[Security\] SketchUp SDK DLL (slapi.dll) leads to Use-After-Free Remote Code Execution Vulnerability

**URL:** <https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483>\
**Category:** SketchUp SDK\
**Created:** [July 24, 2015, 5:45pm UTC](https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483 "2015-07-24T17:45:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![apc152b4](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@apc152b4](https://forums.sketchup.com/u/apc152b4)\
**Post date:** [July 24, 2015, 5:45pm UTC](https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483/1 "2015-07-24T17:45:42Z")

</div>

Dear SketchUp team,

I want to report that slapi.dll is subject to a security vulnerability, use-after-free remote code execution.

Primary vulnerability is due to lack of sanitization of 3D model file as input. By loading the corrputed file the attacker can get the application to access memory that has been previously freed. The use of previously-freed memory can have any number of  
adverse consequences ranging from the corruption of valid data to the execution of arbitrary code.

Sample POC is attached. [poc.skp](https://forums.sketchup.com/uploads/short-url/o4QwvxZ7A1msdb7CnMxyOS8960h.skp) (653.6 KB)

Any software leverages your SDK will be subject to the same security vulnerability.

* * *

File version: 14.0.4900.0

```
Product

```

version: 14.0.4900.0

```
File

```

flags: 0 (Mask 3F)

```
File OS: 40004 NT Win32

File type: 2.0 Dll

File date: 00000000.00000000

```

Translations: 0409.04b0

CompanyName: Trimble Navigation  
Limited

ProductName: SketchUp

InternalName: slapi.dll

OriginalFilename: slapi.dll

ProductVersion: 14.0.4900.0

FileVersion: 14.0.4900.0

FileDescription: SketchUp SDK DLL  
(32-bit)

LegalCopyright: (c) 2014 Trimble  
Navigation Limited

0:005\>

* * *

Please kindly get in touch with me in case you need further information.

Best regards,  
Vic

---

<div class="post-metadata">

**Author:** ![DanRathbun](https://sea2.discourse-cdn.com/sketchup/user_avatar/forums.sketchup.com/danrathbun/32/500_2.png) [@DanRathbun](https://forums.sketchup.com/u/DanRathbun)\
**Post date:** [July 24, 2015, 6:36pm UTC](https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483/2 "2015-07-24T18:36:07Z")

</div>

> [@Vic\_C](#):
>
> File version: **`14.0.4900.0`**

**That is definitely not the latest SDK version !**

Go here: [http://www.sketchup.com/intl/en/developer/sdk\_start.html](http://www.sketchup.com/intl/en/developer/sdk_start.html)  
and download the latest version (which is **`15.3.330.0`** as of this posting.)

Please advise if the vulnerability exists in the current release version.

---

<div class="post-metadata">

**Author:** ![apc152b4](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@apc152b4](https://forums.sketchup.com/u/apc152b4)\
**Post date:** [July 27, 2015, 5:08pm UTC](https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483/3 "2015-07-27T17:08:54Z")

</div>

Hi Dan,

Thanks for your advise…unfortunately, the problem persists with the latest version of SDK.

Please see attached screen-shot showing upgrade has been done.

Best regards,  
Vic ![](https://global.discourse-cdn.com/sketchup/original/2X/8/8d86df9f9f2343f5488ea96c69d96b56d7ca3f16.jpg)

---

<div class="post-metadata">

**Author:** ![apc152b4](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@apc152b4](https://forums.sketchup.com/u/apc152b4)\
**Post date:** [August 17, 2015, 5:46pm UTC](https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483/4 "2015-08-17T17:46:26Z")

</div>

Dear SketchUp Team,

Is there any update to this report? Is there any feedback?

Best regards,  
Vic

---

<div class="post-metadata">

**Author:** ![Tommy](https://sea2.discourse-cdn.com/sketchup/user_avatar/forums.sketchup.com/tommy/32/22258_2.png) [@Tommy](https://forums.sketchup.com/u/Tommy)\
**Post date:** [August 19, 2015, 11:49pm UTC](https://forums.sketchup.com/t/security-sketchup-sdk-dll-slapi-dll-leads-to-use-after-free-remote-code-execution-vulnerability/13483/5 "2015-08-19T23:49:42Z")

</div>

Heya Vic,

I’ll follow up with you via the Forum’s messaging system. Hang on for more info…