Skip to main content

TeX Live CVE-2026-63729

| EUVDEUVD-2026-46144 MEDIUM
Use After Free (CWE-416)
2026-07-21 VulnCheck GHSA-jf22-92mg-7xxh
RCE Use After Free Memory Corruption Red Hat Suse Tex Live
6.8
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.6 MEDIUM

Local file vector with required user interaction (open document); no privileges needed; availability impact high (reliable crash), integrity and confidentiality low (potential but unconfirmed RCE).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
6.6 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jul 21, 2026 - 02:46 vuln.today
Analysis Generated
Jul 21, 2026 - 02:46 vuln.today

DescriptionCVE.org

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

AnalysisAI

Heap use-after-free in the SyncTeX parser shipped with TeX Live and embedded by GNOME Evince allows crash or potential arbitrary code execution when a user opens a malformed .synctex or .synctex.gz file. The flaw stems from a NULL parent pointer condition in _synctex_post_process_ref() that bypasses node detachment, causing recursive freeing of live tree nodes and leaving dangling pointers later accessed during document parsing. Exploitation requires local file access and active user interaction (UI:A per CVSS 4.0), no public exploit has been confirmed, but a detailed researcher blog post by the discoverer (Fatih Çelik) is publicly available and the RCE tag suggests demonstrated impact potential.

Technical ContextAI

SyncTeX is a synchronization protocol between TeX source and PDF output, implemented in synctex_parser.c and distributed as part of TeX Live (CPE: cpe:2.3:a:tex_live:tex_live:*:*:*:*:*:*:*:*). The parser is also embedded by downstream consumers including GNOME Evince. The root cause (CWE-416: Use After Free) is in _synctex_post_process_ref() at line 5799: when __synctex_replace_ref() encounters a ref node with a NULL parent pointer - a condition trivially injectable via fuzzing or crafted input - it exits the error path at line 5771 without resetting the ref's sibling pointer. When synctex_node_free(ref) is then called unconditionally, _synctex_free_leaf() follows the stale sibling pointer and recursively frees nodes that are still part of the live tree. When those nodes are subsequently accessed during tree traversal or destruction, the UAF fires. The patch (commit 002dcd3eac30db5c352f53d4181737961cc7ee9a) resolves this by resetting sibling and child pointers before any recursive free call across _synctex_free_node, _synctex_free_leaf, _synctex_free_input, and the _synctex_post_process_ref site itself.

RemediationAI

The upstream fix is available as commit 002dcd3eac30db5c352f53d4181737961cc7ee9a in the TeX Live source repository at https://github.com/TeX-Live/texlive-source/; however, a tagged patched release version is not independently confirmed in the available data, so administrators should monitor the TeX Live distribution channel and apply updates as they become available. Downstream consumers - particularly GNOME Evince - should patch their embedded copy of synctex_parser.c with the same changes: resetting sibling/child pointers before recursive free calls in _synctex_free_node, _synctex_free_leaf, _synctex_free_input, and adding __synctex_tree_reset_sibling/parent() calls at the _synctex_post_process_ref site before synctex_node_free(ref). As a compensating control where patching is not immediately possible, disabling SyncTeX support in document viewers (if configurable) would eliminate the attack surface - note this trades off forward/inverse search between PDF output and TeX source. Restricting document viewer access to trusted file sources and blocking untrusted .synctex/.synctex.gz files at file transfer boundaries are additional mitigations. VulnCheck advisory is at https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file.

More in Tex Live

View all
CVE-2016-10243 CRITICAL POC
9.8 May 02

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands
CVE-2023-32668 MEDIUM POC
5.5 May 11

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. Rated me
CVE-2017-17513 HIGH
8.8 Dec 14

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment va
CVE-2023-32700 HIGH
7.8 May 20

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted s
CVE-2018-17407 HIGH
7.8 Sep 23

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. Rated

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-63729 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy