Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-63729: TeX Live and Evince crash or code execution risk with malformed SyncTeX files
CVE-2026-63729
Summary
A security issue affects TeX Live and its embedded SyncTeX parser in Evince. If an attacker sends a corrupted SyncTeX file, it can cause the program to crash or potentially run malicious code. To stay safe, ensure your TeX Live and Evince installations are up-to-date with the latest security patches.
Original title
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash app...
Original description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
nvd CVSS3.1
6.6
nvd CVSS4.0
6.8
Vulnerability type
CWE-416
Use After Free
Published: 21 Jul 2026 · Updated: 21 Jul 2026 · First seen: 21 Jul 2026