Is CVE-2026-63729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63729 being exploited in the wild.

How severe is CVE-2026-63729?

Medium severity, with a CVSS score of 6.6, published 21 July 2026.

Which products and versions are affected?

TeX Users Group TeX Live Up to and including TeX Live 2025.

Is there a fix for CVE-2026-63729?

A patch was published on 2026-02-23: Fix committed to TeX Live source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63729 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-63729?

Check whether you run Gnome Evince or TeX Users Group TeX Live at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63729: TeX Live SyncTeX Parser heap use-after-free in synctex_parser.c

CVE-2026-63729 · Severity: medium · CVSS 6.6 · Published 2026-07-21

The SyncTeX parser, a component used by TeX Live and document viewers like GNOME Evince to synchronize source files with PDFs, contains a memory safety flaw. An attacker can exploit this by providing a specially crafted .synctex file, which could cause the application to crash or potentially allow the execution of unauthorized code. This impact is most significant for users who open untrusted LaTeX-related files in document viewers or processing tools.

Vendors: Gnome.

Quick answers

Is CVE-2026-63729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63729 being exploited in the wild.
How severe is CVE-2026-63729?: Medium severity, with a CVSS score of 6.6, published 21 July 2026.
Which products and versions are affected?: TeX Users Group TeX Live Up to and including TeX Live 2025.
Is there a fix for CVE-2026-63729?: A patch was published on 2026-02-23: Fix committed to TeX Live source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63729 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-63729?: Check whether you run Gnome Evince or TeX Users Group TeX Live at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap use-after-free vulnerability exists in synctex_parser.c due to improper node management during recursive freeing. Specifically, a malformed SyncTeX file can define a 'ref' node with a NULL parent pointer, causing the __synctex_replace_ref routine to fail to detach the node from its sibling chain. When the parser subsequently frees this node, the recursive destructor (_synctex_free_node) follows the still-intact sibling pointer and prematurely frees active nodes in the live tree. Subsequent access to these freed nodes during document loading results in a use-after-free. The vulnerability was fixed in TeX Live 2026 and via specific commits to the TeX Live source repository.

Affected products

TeX Live TeX Live Up to and including TeX Live 2025
GNOME Evince

Timeline

2026-02-15: disclosed: Reported to TeX Live security team
2026-02-23: patched: Fix committed to TeX Live source repository
2026-07-21: advisory: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.