TeX Live CVE-2026-63729

The target user must actively open a document with an accompanying malformed .synctex or .synctex.gz file using a SyncTeX-enabled application (TeX Live tools, GNOME Evince, or any downstream consumer embedding synctex_parser.c). The CVSS 4.0 vector confirms AV:L and UI:A: the attacker must be able to place the malicious file in a location accessible to the victim, and the victim must actively open the document. No authentication or elevated privileges are required - opening a file as a regular user is sufficient. Exploitation is limited by: the requirement for user interaction (opening the file), the local attack vector (no remote unauthenticated network-reachable path without social engineering), and the need for the application to process the .synctex companion file (SyncTeX must be active/enabled in the viewer). Non-default or disabled SyncTeX configurations would not be exploitable.

The CVSS 4.0 base score of 6.8 (Medium) appropriately captures the risk profile: AV:L constrains exploitation to scenarios where the attacker can deliver a malformed file to a user who then opens it, and UI:A requires active user interaction, significantly limiting opportunistic mass exploitation. Availability impact is High (crash is reliably achievable), while Confidentiality and Integrity are Low - RCE is plausible but not guaranteed without a working exploit. EPSS data was not provided in the input and cannot be assessed; KEV status is not confirmed, so there is no evidence of active mass exploitation. The researcher's technical blog post and the RCE tag elevate concern above a pure crash-only finding. The wildcard CPE (*:*:*:*:*:*:*:*) suggests all TeX Live versions are affected prior to the patch commit, though no exact vulnerable version range or patched release version is confirmed by the input data. The fact that GNOME Evince embeds synctex_parser.c means the vulnerable code reaches desktop Linux users who may not directly use TeX Live, widening the affected population beyond the TeX user base.

An attacker crafts a malformed .synctex.gz file with a ref node whose parent pointer resolves to NULL, then delivers it alongside a companion PDF document - for example, via email, shared network storage, or a compromised document repository. When the target user opens the PDF in GNOME Evince or another SyncTeX-enabled viewer, the parser processes the malformed ref, the UAF fires as freed sibling nodes are recursively traversed, and the application crashes or - depending on heap layout - executes attacker-controlled code. A detailed technical write-up of the mechanism is publicly available at https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/.