---
id: CVE-2026-63729
title: TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File
summary: >-
  The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by
  downstream consumers such as GNOME Evince contains a heap use-after-free
  vulnerability that allows attackers to crash applications or potentially
  execute arbitra…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: TeX Live
product: TeX Live
affected:
  - tex_live <= TeX Live 2025
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-21T13:18:36.502339Z'
published: '2026-07-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:09.221Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63729'
references:
  - url: 'https://github.com/TeX-Live/texlive-source/'
    label: Product
  - url: >-
      https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a
    label: Patch Commit
  - url: 'https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/'
    label: Blog Post
  - url: >-
      https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06392
ingestedAt: '2026-09-24T15:45:56.723Z'
---

## Overview

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

## Affected

- `tex_live <= TeX Live 2025`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.