Every CVE Search/ Get API key

CVE-2026-63729

TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File

6.8 MediumFix available

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.18%Up 0.1 points since Jul 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
CVE-2026-63729
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-46144 6.8

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
EUVD-2026-46144
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jf22-92mg-7xxh 6.8

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers...

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
GHSA-jf22-92mg-7xxh
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 6.8

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
CVE-2026-63729
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 6.8

TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
CVE-2026-63729
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-63729 6.8

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
DEBIAN-CVE-2026-63729
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2026-3192 6.6

texlive-base security update

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.

Security Fix(es):

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.(CVE-2026-63729)

Record
OESA-2026-3192
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-63729 6.8

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Record
UBUNTU-CVE-2026-63729
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.6 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:11412-1 No score

evince-48.4-2.1 on GA media

These are all security issues fixed in the evince-48.4-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11412-1
Updated
2026-11-02
OSVSUSE-SU-2026:3512-1 No score

Security update for evince

This update for evince fixes the following issue:

  • CVE-2026-63729: texlive: heap use-after-free in synctex_parser.c via a malformed .synctex or .synctex.gz file (bsc#1272433).
Record
SUSE-SU-2026:3512-1
Updated
2026-11-02
OSVSUSE-SU-2026:3628-1 No score

Security update for texlive

This update for texlive fixes the following issues:

  • CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126).
  • CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127).
  • CVE-2026-63729: use-after-free in synctex_parser.c in TeX Live (bsc#1272432).
Record
SUSE-SU-2026:3628-1
Updated
2026-11-02
OSVSUSE-SU-2026:3924-1 No score

Security update for texlive

This update for texlive fixes the following issue:

  • CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processed(bsc#1272432).
Record
SUSE-SU-2026:3924-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
okular
Debian:12
 All versions, plus listed versions
4:22.12.3-14:22.12.3-1+deb12u14:23.08.1-14:23.08.1-24:24.05.2-1
Show 17 moreShow less
4:24.05.2-24:24.05.2-34:24.05.2-44:24.08.2-14:24.08.2-24:24.12.0-14:24.12.0-24:24.12.2-14:25.03.90-14:25.04.0-14:25.04.2-14:25.04.2-24:25.08.3-14:25.11.90-14:26.04.0-14:26.04.2-14:26.08.0-1
 None known
okular
Debian:13
 All versions, plus listed versions
4:25.04.2-14:25.04.2-1+deb13u14:25.04.2-24:25.08.3-14:25.11.90-14:26.04.0-14:26.04.2-14:26.08.0-1
 None known
okular
Debian:14
 All versions, plus listed versions
4:25.04.2-14:25.04.2-24:25.08.3-14:25.11.90-14:26.04.0-14:26.04.2-14:26.08.0-1
 None known
texlive-bin
Debian:12
 All versions, plus listed versions
2022.20220321.62855-5.12022.20220321.62855-5.1+deb12u12022.20220321.62855-5.1+deb12u22022.20220321.62855-62022.20220321.62855-7
Show 27 moreShow less
2022.20220321.62855-82023.20230311.66589-12023.20230311.66589-22023.20230311.66589-32023.20230311.66589-42023.20230311.66589-52023.20230311.66589-62023.20230311.66589-72023.20230311.66589-82023.20230311.66589-92024.20240313.70630+ds-12024.20240313.70630+ds-22024.20240313.70630+ds-32024.20240313.70630+ds-42024.20240313.70630+ds-52024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-42025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5
 None known
texlive-bin
Debian:13
 All versions, plus listed versions
2024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-4
Show 7 moreShow less
2025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5
 None known
texlive-bin
Debian:14
 before 2026.20260303.78225+ds-2, plus listed versions
2024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-42025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-1
2026.20260303.78225+ds-2
texstudio
Debian:12
 All versions, plus listed versions
4.3.1+ds-24.3.1+ds-34.7.2+ds-14.7.2+ds-24.8.0+ds-1
Show 14 moreShow less
4.8.1+ds-14.8.2+ds-14.8.4+ds-14.8.4+ds-24.8.5+ds-14.8.6+ds-14.8.7+ds-14.8.8+ds-14.8.9+ds-14.9.0+ds-14.9.1+ds-14.9.2+ds-14.9.6+ds-14.9.7+ds-1
 None known
texstudio
Debian:13
 All versions, plus listed versions
4.8.7+ds-14.8.8+ds-14.8.9+ds-14.9.0+ds-14.9.1+ds-14.9.2+ds-14.9.6+ds-14.9.7+ds-1
 None known
texstudio
Debian:14
 before 4.9.6+ds-1, plus listed versions
4.8.7+ds-14.8.8+ds-14.8.9+ds-14.9.0+ds-14.9.1+ds-14.9.2+ds-1
4.9.6+ds-1
texlive-base
openEuler:20.03-LTS-SP4
 before 20180414-36.oe2003sp4
20180414-36.oe2003sp4
Show 15 moreShow less
Affected packages
PackageAffectedFixed
texlive-base
openEuler:22.03-LTS-SP4
 before 20180414-41.oe2203sp4
20180414-41.oe2203sp4
texlive-base
openEuler:24.03-LTS-SP1
 before 20210325-14.oe2403sp1
20210325-14.oe2403sp1
texlive-base
openEuler:24.03-LTS-SP3
 before 20210325-14.oe2403sp3
20210325-14.oe2403sp3
texlive-base
openEuler:24.03-LTS-SP4
 before 20210325-14.oe2403sp4
20210325-14.oe2403sp4
evince
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 45.0-150600.3.6.1
45.0-150600.3.6.1
texlive
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 2021.20210325-150600.38.3.1
2021.20210325-150600.38.3.1
texlive
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 3 CVEs
 before 2021.20210325-150600.38.3.1
2021.20210325-150600.38.3.1
texlive
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2013.20130620-22.14.1
2013.20130620-22.14.1
texlive-bin
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2015.20150524.37493-5build12015.20150524.37493-72015.20150524.37493-7build12015.20150524.37493-7build42015.20160222.37495-12015.20160222.37495-1ubuntu0.12015.20160222.37495-1ubuntu0.1+esm1
 None known
texlive-bin
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2017.20170613.44572-5build12017.20170613.44572-5build22017.20170613.44572-62017.20170613.44572-6build12017.20170613.44572-6ubuntu1
Show 4 moreShow less
2017.20170613.44572-8build12017.20170613.44572-8ubuntu0.12017.20170613.44572-8ubuntu0.22017.20170613.44572-8ubuntu0.2+esm1
 None known
texlive-bin
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2019.20190605.51237-2build12019.20190605.51237-32019.20190605.51237-3build12019.20190605.51237-3build22019.20190605.51237-3ubuntu0.12019.20190605.51237-3ubuntu0.22019.20190605.51237-3ubuntu0.2+esm1
 None known
texlive-bin
Ubuntu:22.04:LTS
 All versions, plus listed versions
2020.20200327.54578-72020.20200327.54578-7build12021.20210626.59705-12021.20210626.59705-1build12021.20210626.59705-1ubuntu0.12021.20210626.59705-1ubuntu0.22021.20210626.59705-1ubuntu0.3
 None known
texlive-bin
Ubuntu:24.04:LTS
 All versions, plus listed versions
2023.20230311.66589-62023.20230311.66589-72023.20230311.66589-82023.20230311.66589-8build12023.20230311.66589-92023.20230311.66589-9build22023.20230311.66589-9build3
 None known
texlive-bin
Ubuntu:26.04:LTS
 All versions, plus listed versions
2024.20240313.70630+ds-6ubuntu22025.20250727.75242+ds-4ubuntu22025.20250727.75242+ds-52025.20250727.75242+ds-5build1
 None known
evince
openSUSE:Tumbleweed
 before 48.4-2.1
48.4-2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63729 is a medium vulnerability (CVSS 6.8) in Tex Live Live, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in texlive-bin 2026.20260303.78225+ds-2.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open