Vulnerability Description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/
- https://github.com/TeX-Live/texlive-source/
- https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737
- https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free
FAQ
What is CVE-2026-63729?
CVE-2026-63729 is a vulnerability with a CVSS score of 6.6 (MEDIUM). The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applic...
How severe is CVE-2026-63729?
CVE-2026-63729 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-63729?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.