# CVE-2026-63729: TeX Live SyncTeX Parser heap use-after-free in synctex_parser.c

Source: https://junglewise.ai/threats/cve-2026-63729-tex-live-synctex-parser-heap-use-after-free-in-synctex-parser-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-63729 · Severity: medium · CVSS 6.6 · Published 2026-07-21

The SyncTeX parser, a component used by TeX Live and document viewers like GNOME Evince to synchronize source files with PDFs, contains a memory safety flaw. An attacker can exploit this by providing a specially crafted .synctex file, which could cause the application to crash or potentially allow the execution of unauthorized code. This impact is most significant for users who open untrusted LaTeX-related files in document viewers or processing tools.

Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2026-63729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63729 being exploited in the wild.

**How severe is CVE-2026-63729?** Medium severity, with a CVSS score of 6.6, published 21 July 2026.

**Which products and versions are affected?** TeX Users Group TeX Live Up to and including TeX Live 2025.

**Is there a fix for CVE-2026-63729?** A patch was published on 2026-02-23: Fix committed to TeX Live source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63729 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-63729?** Check whether you run Gnome Evince or TeX Users Group TeX Live at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap use-after-free vulnerability exists in synctex_parser.c due to improper node management during recursive freeing. Specifically, a malformed SyncTeX file can define a 'ref' node with a NULL parent pointer, causing the __synctex_replace_ref routine to fail to detach the node from its sibling chain. When the parser subsequently frees this node, the recursive destructor (_synctex_free_node) follows the still-intact sibling pointer and prematurely frees active nodes in the live tree. Subsequent access to these freed nodes during document loading results in a use-after-free. The vulnerability was fixed in TeX Live 2026 and via specific commits to the TeX Live source repository.

## Affected products

- TeX Live TeX Live Up to and including TeX Live 2025
- GNOME Evince

## Timeline

- 2026-02-15: disclosed: Reported to TeX Live security team
- 2026-02-23: patched: Fix committed to TeX Live source repository
- 2026-07-21: advisory: Public disclosure and CVE assignment

## References

- [https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/](https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/)
- [https://github.com/TeX-Live/texlive-source/](https://github.com/TeX-Live/texlive-source/)
- [https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a](https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a)
- [https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file](https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file)

## Related threats

- [MATE Atril and GNOME Evince argument injection in ev_spawn](https://junglewise.ai/threats/cve-2026-46529-mate-atril-and-gnome-evince-argument-injection-in-ev-spawn)