CVE-2026-63729
TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File
CVSS Score
6.6
EPSS Score
0.0%
EPSS Percentile
0th
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
| CWE | CWE-416 |
| Vendor | tex live |
| Product | tex live |
| Published | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for tex live tex live
Be the first to know when new medium vulnerabilities affecting tex live tex live are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High
Affected Versions
TeX Live / TeX Live
0 ≤ TeX Live 2025
References
github.com: https://github.com/TeX-Live/texlive-source/ github.com: https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a fatihhcelik.github.io: https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/ vulncheck.com: https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file
Credits
🔍 Fatih Çelik