CVE-2026-63729 TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File
Attackers can execute arbitrary code or crash applications by providing a malformed SyncTeX file to TeX Live or dependent viewers like Evince.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63729?
CVE-2026-63729 is a medium-severity use after free vulnerability in TeX Live, published on 21 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
Weakness: CWE-416
Which versions are affected by CVE-2026-63729?
Linux distribution packages (3)
evince SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | All versions | 45.0-150600.3.6.1 |
texlive SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2013.20130620-22.14.1 |
evince openSUSE:Tumbleweed | All versions | 48.4-2.1 |
How do I fix CVE-2026-63729?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-63729 being exploited?
There is no known exploitation of CVE-2026-63729 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-63729, ECHO-29b4-3924-6adf, GHSA-jf22-92mg-7xxh, OESA-2026-3192, SUSE-SU-2026:3512-1, SUSE-SU-2026:3924-1 and 2 more.