{"id":"CVE-2026-63729","summary":"TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File","details":"The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.","modified":"2026-09-10T18:26:48.369496150Z","published":"2026-07-21T01:35:41.899Z","related":["SUSE-SU-2026:3512-1","SUSE-SU-2026:3628-1","SUSE-SU-2026:3924-1","openSUSE-SU-2026:11412-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63729.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"last_affected":"TeX Live 2025"}]},{"extracted_events":[{"last_affected":"2025"}],"source":"CPE_FIELD"}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-416"]},"references":[{"type":"WEB","url":"https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/"},{"type":"WEB","url":"https://github.com/TeX-Live/texlive-source/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63729.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63729"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file"},{"type":"FIX","url":"https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tex-live/texlive-source","events":[{"introduced":"0"},{"fixed":"002dcd3eac30db5c352f53d4181737961cc7ee9a"}],"database_specific":{"source":"REFERENCES"}}],"versions":["svn78021","svn77965","svn77897","svn77745","svn77609","svn74504","svn74361","svn74153","svn74112","svn74095","svn74048","svn73908","svn73771","svn70567","svn70552","svn70551","svn70500","svn70487","svn70431","svn70406","svn70285","svn70263","svn69815","svn69778","svn69773","svn69770","svn69767b","svn69767","svn66539","svn66508","svn66081","svn65870","svn62653","svn62591","r62569","svn62544","svn62529","svn62388","svn62297","svn62182","svn62180","svn58837","svn58833","svn58528","svn58431","svn58361","svn58132","svn57874","svn54456","svn54408","svn54337","svn54259","svn53987","svn51092","svn50904","build-svn50882","build-svn50838","build-svn50777","build-svn50687","build-svn50573","pretest-build-svn50430","pretest-build-svn50419","pretest-build-20190312","pretest-build-20190307","pretest-build-20190228","texlive-2018.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63729.json","vanir_signatures_modified":"2026-08-12T16:09:57Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a","target":{"file":"texk/web2c/synctexdir/synctex_parser.c","function":"_synctex_free_node"},"deprecated":false,"digest":{"length":198,"function_hash":"121387933641489108124302864517853389478"},"id":"CVE-2026-63729-088f9a20","signature_type":"Function"},{"digest":{"length":164,"function_hash":"15645277229190487318491780588187520044"},"id":"CVE-2026-63729-11fe1400","signature_type":"Function","signature_version":"v1","source":"https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a","target":{"file":"texk/web2c/synctexdir/synctex_parser.c","function":"_synctex_free_leaf"},"deprecated":false},{"source":"https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a","target":{"file":"texk/web2c/synctexdir/synctex_parser.c","function":"_synctex_post_process_ref"},"deprecated":false,"digest":{"function_hash":"311753762499122575376331284502015693136","length":361},"id":"CVE-2026-63729-7c780149","signature_type":"Function","signature_version":"v1"},{"target":{"file":"texk/web2c/synctexdir/synctex_parser.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["134784100660891033311371474205321530100","139759690503169970590720076022020568762","336358598549248842533305888370209485727","122052318861836330951565073801335727810","195000724521589966068106080680520989465","277506988175509270554170281566602130429","327007757019526268329960456484154441841","217602491223929101488238518517892594952","79910622192875238226083166402010964848","138793327750411863113748809062090337956","264129152875749384105511823537199740353","122052318861836330951565073801335727810","41903845615338752948500163373420527959","199238158216491960083008974325129042239","268967799970453992192573408118041386285","214155950842980569392995029920831021958","225434404697531273024362141827533806127","326163525541177139495997479153721622848","122052318861836330951565073801335727810","285188597816193559352696163511784760305","289476773606683165103802060145674659209","880451813427028491497904788752006902","26119726301131591232392010997876865588","32263038807851844681189512908731009673","146405971274187178020954771264176313918","138035169848441241145657175118710083518"]},"id":"CVE-2026-63729-afe564bd","signature_type":"Line","signature_version":"v1","source":"https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a"},{"digest":{"function_hash":"87530518094079038522523298463963855941","length":189},"id":"CVE-2026-63729-f0b1d830","signature_type":"Function","signature_version":"v1","source":"https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a","target":{"function":"_synctex_free_input","file":"texk/web2c/synctexdir/synctex_parser.c"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N"}]}