CVE-2026-63729
Last modified
CVE-2026-63729 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.. EPSS estimates a 0.12% chance of exploitation in the next 30 days.
Description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TeX Live | TeX Live | <= TeX Live 2025 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-63729?
How severe is CVE-2026-63729?
How do I fix CVE-2026-63729?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-6371Improper neutralization of input during web page generation …4.8
- CVE-2026-6372Missing Authorization vulnerability in Plisio Accept Cryptoc…7.5
- CVE-2026-63720datamodel-code-generator prior to version 0.70.0 contains a …7.5
- CVE-2026-63725sysPass's FileBackupService::doBackupFiles() in lib/SP/Servi…8.6
- CVE-2026-63727Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 …8.8
- CVE-2026-63728Gitleaks prior to 8.30.1 contains a template injection vulne…8.1
- CVE-2026-6373Exposure of sensitive system information to an unauthorized …6.5
- CVE-2026-63730HyperDX before 2.31.0 contains a server-side request forgery…5.3
- CVE-2026-63731HyperDX before 2.31.0 contains a server-side request forgery…7.7
- CVE-2026-637329router 0.4.59 (fixed in 0.4.60) contains a chain of vulnera…9.9
- CVE-2026-63733SurrealDB versions before 3.2.0 contain a permissions bypass…6.5
- CVE-2026-63734SurrealDB versions before 3.2.0 contain a denial of service …6.9
Are you affected by CVE-2026-63729?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST