Executive brief
The SyncTeX parser, a component used by TeX Live and document viewers like GNOME Evince to synchronize source files with PDFs, contains a memory safety flaw. An attacker can exploit this by providing a specially crafted .synctex file, which could cause the application to crash or potentially allow the execution of unauthorized code. This impact is most significant for users who open untrusted LaTeX-related files in document viewers or processing tools.
Technical details
A heap use-after-free vulnerability exists in synctex_parser.c due to improper node management during recursive freeing. Specifically, a malformed SyncTeX file can define a 'ref' node with a NULL parent pointer, causing the __synctex_replace_ref routine to fail to detach the node from its sibling chain. When the parser subsequently frees this node, the recursive destructor (_synctex_free_node) follows the still-intact sibling pointer and prematurely frees active nodes in the live tree. Subsequent access to these freed nodes during document loading results in a use-after-free. The vulnerability was fixed in TeX Live 2026 and via specific commits to the TeX Live source repository.
Affected products
- TeX Live TeX Live Up to and including TeX Live 2025
- GNOME Evince
Timeline
- 2026-02-15: disclosed: Reported to TeX Live security team
- 2026-02-23: patched: Fix committed to TeX Live source repository
- 2026-07-21: advisory: Public disclosure and CVE assignment
References
- https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/
- https://github.com/TeX-Live/texlive-source/
- https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a
- https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file