CVE-2026-63729
Received Received - Intake

Heap Use-After-Free in SyncTeX Parser

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-63729
EUVD
EUVD-2026-46144

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tex_users_group tex_live to 2025 (inc)
gnome evince *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63729 is a heap use-after-free vulnerability in the SyncTeX parser (synctex_parser.c) used by TeX Live and embedded in applications like GNOME Evince. It occurs when a malformed .synctex or .synctex.gz file creates a reference node with a NULL parent pointer. This prevents proper detachment from the sibling chain, causing recursive freeing of live tree nodes and leaving dangling pointers. Later access to these pointers during document loading can crash applications or potentially execute arbitrary code.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using the SyncTeX parser (e.g., Evince) when processing .synctex or .synctex.gz files. Use tools like AddressSanitizer to identify heap use-after-free issues during file parsing.

Impact Analysis

This vulnerability allows attackers to crash applications like Evince by supplying a malformed SyncTeX file. In worst cases, it may enable arbitrary code execution, potentially compromising the system. Users opening untrusted documents with embedded SyncTeX data are at risk. The impact is higher for systems processing SyncTeX files from untrusted sources.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a technical flaw in the SyncTeX parser that could allow arbitrary code execution or crashes via malformed files. Compliance impacts would depend on how the affected software (e.g., TeX Live, GNOME Evince) is used in systems handling regulated data.

Mitigation Strategies

Update TeX Live to a version containing the fix (commit 002dcd3 or later). Avoid opening untrusted .synctex or .synctex.gz files. If using Evince, ensure you have the patched version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart