What’s Vulnerable › Vulnerabilities

CVE-2026-63729: TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-07-23
• Weakness: CWE-416

Description

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Affected products

• TeX Live: through TeX Live 2025

References

• https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/
• https://github.com/TeX-Live/texlive-source/
• https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a
• https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file

Get alerted when CVE-2026-63729 or the next vulnerability affects your stack