Log in Start free

Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-63729TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File

Medium 6.6

In plain English

A medium-severity use-after-free in TeX Live from TeX Live. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.2%top 92.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12okularno fix listedDEBIAN-CVE-2026-63729
Debian:13okularno fix listedDEBIAN-CVE-2026-63729
Debian:14okularno fix listedDEBIAN-CVE-2026-63729
Debian:12texlive-binno fix listedDEBIAN-CVE-2026-63729
Debian:13texlive-binno fix listedDEBIAN-CVE-2026-63729
Debian:14texlive-bin2026.20260303.78225+ds-2DEBIAN-CVE-2026-63729
Debian:12texstudiono fix listedDEBIAN-CVE-2026-63729
Debian:13texstudiono fix listedDEBIAN-CVE-2026-63729
Debian:14texstudio4.9.6+ds-1DEBIAN-CVE-2026-63729
Ubuntu:22.04:LTStexlive-binno fix listedUBUNTU-CVE-2026-63729
Ubuntu:24.04:LTStexlive-binno fix listedUBUNTU-CVE-2026-63729
Ubuntu:26.04:LTStexlive-binno fix listedUBUNTU-CVE-2026-63729

Affected products (as reported)

VendorProductVersions
TeX Live TeX Live 0 – through TeX Live 2025

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

References