CVE-2026-63729 Details
Description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
A heap use-after-free vulnerability has been identified in the SyncTeX parser within TeX Live, up to and including version 2025. This vulnerability allows attackers to crash applications or potentially execute arbitrary code by using a malformed .synctex or .synctex.gz file. The issue arises when a malformed SyncTeX file creates a reference node with a NULL parent pointer. This causes the parser's replacement routine to fail in detaching the node from its sibling chain, leading to a recursive freeing of live tree nodes. This process leaves dangling pointers that the parser later accesses during document loading, creating the vulnerability.
Users can upgrade to TeX Live 2026, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/ | [email protected] | ExploitTechnical Analysis |
| https://github.com/TeX-Live/texlive-source/ | [email protected] | Source CodeVendor |
| https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TeX Live | <= 2025 |
CPE
Remediation
| |
| GNOME Evince | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |