{"id":"CVE-2026-63729","aliases":["DEBIAN-CVE-2026-63729","EUVD-2026-46144","GHSA-jf22-92mg-7xxh","OESA-2026-3192","SUSE-SU-2026:3512-1","SUSE-SU-2026:3628-1","SUSE-SU-2026:3924-1","UBUNTU-CVE-2026-63729","openSUSE-SU-2026:11412-1"],"status":"published","title":"TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00176,"percentile":0.07198,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-07-21T01:35:41Z","modified":"2026-10-28T10:55:09Z","fixes":[{"ecosystem":"Debian:14","package":"texlive-bin","fixed_in":["2026.20260303.78225+ds-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"texstudio","fixed_in":["4.9.6+ds-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"texlive-base","fixed_in":["20180414-36.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"texlive-base","fixed_in":["20180414-41.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"texlive-base","fixed_in":["20210325-14.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"texlive-base","fixed_in":["20210325-14.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"texlive-base","fixed_in":["20210325-14.oe2403sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"evince","fixed_in":["45.0-150600.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"texlive","fixed_in":["2013.20130620-22.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"evince","fixed_in":["48.4-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"okular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:22.12.3-1","4:22.12.3-1+deb12u1","4:23.08.1-1","4:23.08.1-2","4:24.05.2-1","4:24.05.2-2","4:24.05.2-3","4:24.05.2-4","4:24.08.2-1","4:24.08.2-2","4:24.12.0-1","4:24.12.0-2","4:24.12.2-1","4:25.03.90-1","4:25.04.0-1","4:25.04.2-1","4:25.04.2-2","4:25.08.3-1","4:25.11.90-1","4:26.04.0-1","4:26.04.2-1","4:26.08.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"okular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.04.2-1","4:25.04.2-1+deb13u1","4:25.04.2-2","4:25.08.3-1","4:25.11.90-1","4:26.04.0-1","4:26.04.2-1","4:26.08.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"okular","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:25.04.2-1","4:25.04.2-2","4:25.08.3-1","4:25.11.90-1","4:26.04.0-1","4:26.04.2-1","4:26.08.0-1"]},{"source":"osv","ecosystem":"Debian:12","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.20220321.62855-5.1","2022.20220321.62855-5.1+deb12u1","2022.20220321.62855-5.1+deb12u2","2022.20220321.62855-6","2022.20220321.62855-7","2022.20220321.62855-8","2023.20230311.66589-1","2023.20230311.66589-2","2023.20230311.66589-3","2023.20230311.66589-4","2023.20230311.66589-5","2023.20230311.66589-6","2023.20230311.66589-7","2023.20230311.66589-8","2023.20230311.66589-9","2024.20240313.70630+ds-1","2024.20240313.70630+ds-2","2024.20240313.70630+ds-3","2024.20240313.70630+ds-4","2024.20240313.70630+ds-5","2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"Debian:13","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"Debian:14","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.20260303.78225+ds-2"}]}],"versions":["2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1"]},{"source":"osv","ecosystem":"Debian:12","package":"texstudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1+ds-2","4.3.1+ds-3","4.7.2+ds-1","4.7.2+ds-2","4.8.0+ds-1","4.8.1+ds-1","4.8.2+ds-1","4.8.4+ds-1","4.8.4+ds-2","4.8.5+ds-1","4.8.6+ds-1","4.8.7+ds-1","4.8.8+ds-1","4.8.9+ds-1","4.9.0+ds-1","4.9.1+ds-1","4.9.2+ds-1","4.9.6+ds-1","4.9.7+ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"texstudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.7+ds-1","4.8.8+ds-1","4.8.9+ds-1","4.9.0+ds-1","4.9.1+ds-1","4.9.2+ds-1","4.9.6+ds-1","4.9.7+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"texstudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.6+ds-1"}]}],"versions":["4.8.7+ds-1","4.8.8+ds-1","4.8.9+ds-1","4.9.0+ds-1","4.9.1+ds-1","4.9.2+ds-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-36.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180414-41.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-14.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-14.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-14.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.0-150600.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150600.38.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150600.38.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.20130620-22.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.20150524.37493-5build1","2015.20150524.37493-7","2015.20150524.37493-7build1","2015.20150524.37493-7build4","2015.20160222.37495-1","2015.20160222.37495-1ubuntu0.1","2015.20160222.37495-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2017.20170613.44572-5build1","2017.20170613.44572-5build2","2017.20170613.44572-6","2017.20170613.44572-6build1","2017.20170613.44572-6ubuntu1","2017.20170613.44572-8build1","2017.20170613.44572-8ubuntu0.1","2017.20170613.44572-8ubuntu0.2","2017.20170613.44572-8ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2019.20190605.51237-2build1","2019.20190605.51237-3","2019.20190605.51237-3build1","2019.20190605.51237-3build2","2019.20190605.51237-3ubuntu0.1","2019.20190605.51237-3ubuntu0.2","2019.20190605.51237-3ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2020.20200327.54578-7","2020.20200327.54578-7build1","2021.20210626.59705-1","2021.20210626.59705-1build1","2021.20210626.59705-1ubuntu0.1","2021.20210626.59705-1ubuntu0.2","2021.20210626.59705-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.20230311.66589-6","2023.20230311.66589-7","2023.20230311.66589-8","2023.20230311.66589-8build1","2023.20230311.66589-9","2023.20230311.66589-9build2","2023.20230311.66589-9build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6ubuntu2","2025.20250727.75242+ds-4ubuntu2","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4-2.1"}]}]}],"products":[{"vendor":"tex live","product":"tex live"}],"references":[{"url":"https://github.com/TeX-Live/texlive-source/","tags":["product","web"]},{"url":"https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a","tags":["patch","fix"]},{"url":"https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/","tags":["web","report"]},{"url":"https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63729","tags":["advisory"]},{"url":"https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free"},{"url":"https://github.com/TeX-Live/texlive-source"},{"url":"https://github.com/advisories/GHSA-jf22-92mg-7xxh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63729.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63729","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3192","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263512-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272433","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63729","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222126","tags":["report"]},{"url":"https://bugzilla.suse.com/1222127","tags":["report"]},{"url":"https://bugzilla.suse.com/1272432","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46051","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263924-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63729","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63729","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-63729","title":"TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T01:35:41.899Z","modified":"2026-09-24T14:18:09.221Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-46144","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T01:35:41Z","modified":"2026-09-24T14:18:09Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:58.186745Z"}],"ghsa":[{"id":"GHSA-jf22-92mg-7xxh","title":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers...","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T03:32:09Z","modified":"2026-07-21T03:32:16Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:09:37.555146Z"}],"nvd":[{"id":"CVE-2026-63729","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T03:16:42.47Z","modified":"2026-07-23T15:24:59.88Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"CVE-2026-63729","title":"TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T01:35:41.899Z","modified":"2026-10-28T10:55:09.705159682Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-63729","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T03:16:42.47Z","modified":"2026-10-01T03:03:30.991906121Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"OESA-2026-3192","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\n\nThe SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.(CVE-2026-63729)","status":"published","published":"2026-08-01T11:12:04Z","modified":"2026-08-18T01:21:25.119044438Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-63729","description":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","status":"published","published":"2026-07-21T03:16:00Z","modified":"2026-07-29T10:17:39.744526894Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"openSUSE-SU-2026:11412-1","title":"evince-48.4-2.1 on GA media","description":"These are all security issues fixed in the evince-48.4-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-31T00:00:00Z","modified":"2026-08-01T09:45:06.012418935Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3512-1","title":"Security update for evince","description":"This update for evince fixes the following issue:\n\n- CVE-2026-63729: texlive: heap use-after-free in `synctex_parser.c` via a malformed `.synctex` or `.synctex.gz` file\n  (bsc#1272433).\n","status":"published","published":"2026-08-05T18:03:32Z","modified":"2026-08-06T11:15:07.903437842Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3628-1","title":"Security update for texlive","description":"This update for texlive fixes the following issues:\n\n- CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126).\n- CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127).\n- CVE-2026-63729: use-after-free in synctex_parser.c in TeX Live (bsc#1272432).\n","status":"published","published":"2026-08-17T16:42:30Z","modified":"2026-08-18T09:30:06.064122252Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3924-1","title":"Security update for texlive","description":"This update for texlive fixes the following issue:\n\n- CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution\n  when malformed `.synctex` or `.synctex.gz` files are processed(bsc#1272432).\n","status":"published","published":"2026-09-02T14:55:25Z","modified":"2026-09-10T18:23:17.757347242Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}