b2b-daily
Home | IT | Cyber Security

Microsoft 365’s Inclusion of SketchUp 3D Library Reveals Numerous Vulnerabilities

Avatar photo
by Paige Williams
November 2, 2023
Image Credit: Other
Microsoft 365’s Inclusion of SketchUp 3D Library Reveals Numerous Vulnerabilities
Table of Contents
  1. Disclosure of High-Severity Bugs
  2. Impact on Microsoft 365 Users
  3. Discovery of Numerous Vulnerabilities
  4. Severity Assessment by Microsoft
  5. Exploit Scenarios and Precautions
  6. Background on SketchUp

Microsoft’s inclusion of support for the SketchUp 3D Library in Microsoft 365 presents a noteworthy security concern for users. The integration of SketchUp into the cloud-based productivity and collaboration tools has been identified as a vulnerability. This article aims to delve into the disclosure of high-severity bugs, the bypassing of fixes, the impact on Microsoft 365 users, the discovery of multiple vulnerabilities, Microsoft’s assessment of severity, exploit scenarios, and provide background information on SketchUp.

Disclosure of High-Severity Bugs

Last December, researchers from Trend Micro’s Zero-Day Initiative (ZDI) revealed four high-severity remote code execution bugs in Microsoft 365. These bugs specifically affected the parsing of SketchUp files within the software suite. Microsoft promptly assigned three CVE (Common Vulnerabilities and Exposures) identifiers – CVE-2023-28285, CVE-2023-29344, and CVE-2023-33146 – and released patches to address these vulnerabilities in the May and June security updates.

Despite the patches, ThreatLabz researchers managed to develop a bypass for the fixes, prompting Microsoft to disable support for SketchUp in June of 2023. Initially described as a temporary measure, support for SketchUp remains disabled in Microsoft 365. This disabling emphasizes the severity of the vulnerabilities associated with SketchUp integration within the software suite.

Impact on Microsoft 365 Users

SketchUp is one of the most widely used formats available to Microsoft 365 users for inserting 3D files into applications such as Word, Excel, Outlook, and PowerPoint. Its popularity makes the vulnerabilities all the more concerning as it increases the potential attack surface for hackers aiming to exploit the weaknesses. Users must exercise caution when dealing with SketchUp files and consider alternative 3D file formats to mitigate the risks.

Discovery of Numerous Vulnerabilities

The Zscaler ThreatLabz researchers uncovered a staggering 117 vulnerabilities related to SketchUp when analyzing the dynamic link library responsible for parsing 3D file formats in Microsoft 365 apps. This discovery demonstrates the extent to which the integration of SketchUp has introduced potential avenues for attackers to exploit the software suite’s security.

Severity Assessment by Microsoft

After assessing the vulnerabilities, Microsoft classified them as being of important severity, which is marginally lower in terms of remediation priority than critical severity bugs. This classification emphasizes the significance of addressing these vulnerabilities promptly to ensure the overall security of Microsoft 365 and its users.

Exploit Scenarios and Precautions

Microsoft has described the vulnerabilities as issues that attackers can only exploit by tricking potential victims into running malicious files. This underscores the need for users to exercise caution when handling SketchUp files and to be vigilant against potential phishing attempts or other social engineering tactics that may lead to the execution of such files.

Background on SketchUp

SketchUp was first developed by @Last Software in 2000 and later transitioned to Google in 2006. It is now owned by Trimble Navigation. Over the years, SketchUp has become one of the most widely recognized and utilized 3D modeling tools available. Its versatility and ease of use have made it popular among professionals and amateur designers alike, contributing to its prominence in the 3D file format landscape.

The integration of SketchUp within Microsoft 365’s suite of cloud-based productivity and collaboration tools has unintentionally exposed users to numerous vulnerabilities. Despite patches released by Microsoft, the bypass discovered by ThreatLabz researchers forced the company to temporarily disable support for SketchUp. The discovery of 117 vulnerabilities highlights the potential risks associated with this integration. Microsoft’s classification of the vulnerabilities as being of high severity reinforces the need for users to remain vigilant and adopt additional security measures when handling SketchUp files. As Microsoft works to address these vulnerabilities, users must prioritize security to ensure the safety of their data and systems within the Microsoft 365 environment.

Information SecurityMicrosoft

Explore more

Is UiPath Stock a Genuine Bargain or a Value Trap?
July 16, 2026

The rapid evolution of robotic process automation into the sophisticated realm of agentic artificial intelligence has left many investors questioning whether pioneers like UiPath still hold a competitive edge in an increasingly crowded software market. While the company once dominated the landscape by automating repetitive tasks, the current technological shift demands a much deeper integration of cognitive capabilities that can

How Does the ClaudeFix Campaign Exploit Trust in AI?
July 16, 2026

As artificial intelligence platforms become central to daily productivity, threat actors have shifted their focus toward subverting the inherent credibility of these tools to facilitate sophisticated social engineering schemes. The emergence of the ClaudeFix campaign demonstrates an alarming evolution in cybercrime, where attackers no longer rely solely on poorly designed spoofed websites but instead leverage the legitimate infrastructure of major

Ransomware Costs Rise as Tactics Shift to Identity Theft
July 16, 2026

The digital extortion landscape has undergone a radical transformation as traditional file encryption loses its efficacy against organizations that have finally mastered the art of robust, offline backup solutions. While the initial ransomware wave relied on locking down systems to demand a fee, modern threat actors like LockBit and BlackCat have pivoted toward a more insidious strategy: stealing the very

Kratos Phishing Kit Surge Targets Microsoft 365 Accounts
July 16, 2026

Cybersecurity landscapes shift rapidly when automated toolkits like Kratos emerge to dismantle traditional defensive perimeters around corporate productivity suites. This particular phishing framework represents a significant evolution in the commodification of cybercrime, providing even low-skill actors with the means to compromise high-value targets. By focusing specifically on Microsoft 365 environments, the developers of Kratos have tapped into the primary repository

Is AI Turning Security Patches Into Cyber Weapons?
July 16, 2026

For nearly three decades, the release of a software patch was viewed as the definitive end to a vulnerability’s lifecycle, providing a clear signal for administrators to begin the protective process. However, the emergence of advanced machine learning models has fundamentally altered this defensive dynamic, transforming the very cure into a specialized diagnostic tool for adversaries. This phenomenon, known as