Skip to main content

Tex Live

6 CVEs product

Monthly

CVE-2026-63729 Jul 21, 01:35 MEDIUM PATCH This Month

Heap use-after-free in the SyncTeX parser shipped with TeX Live and embedded by GNOME Evince allows crash or potential arbitrary code execution when a user opens a malformed .synctex or .synctex.gz file. The flaw stems from a NULL parent pointer condition in _synctex_post_process_ref() that bypasses node detachment, causing recursive freeing of live tree nodes and leaving dangling pointers later accessed during document parsing. Exploitation requires local file access and active user interaction (UI:A per CVSS 4.0), no public exploit has been confirmed, but a detailed researcher blog post by the discoverer (Fatih Çelik) is publicly available and the RCE tag suggests demonstrated impact potential.

RCE Use After Free Memory Corruption Red Hat Suse +1
NVD GitHub VulDB
CVSS 4.0
6.8
EPSS
0.1%
CVE-2023-32700 May 20, 18:15 HIGH PATCH This Week

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.

Command Injection Tex Live Luatex Miktex Tug
NVD GitHub
CVSS 3.1
7.8
EPSS
0.8%
CVE-2023-32668 May 11, 06:15 MEDIUM POC PATCH This Month

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Tex Live Luatex Miktex Tug
NVD
CVSS 3.1
5.5
EPSS
0.4%
CVE-2018-17407 Sep 23, 21:29 HIGH PATCH This Week

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

RCE Buffer Overflow Debian Canonical Debian Linux +3
NVD GitHub
CVSS 3.0
7.8
EPSS
2.1%
CVE-2017-17513 Dec 14, 16:29 HIGH This Week

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Tex Live Tug
NVD
CVSS 3.0
8.8
EPSS
0.5%
CVE-2016-10243 May 02, 14:59 CRITICAL POC PATCH THREAT Act Now

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 10.6%.

Information Disclosure Debian Debian Linux Fedora Tex Live +2
NVD
CVSS 3.0
9.8
EPSS
10.6%
EPSS 0% CVSS 6.8
MEDIUM PATCH This Month

Heap use-after-free in the SyncTeX parser shipped with TeX Live and embedded by GNOME Evince allows crash or potential arbitrary code execution when a user opens a malformed .synctex or .synctex.gz file. The flaw stems from a NULL parent pointer condition in _synctex_post_process_ref() that bypasses node detachment, causing recursive freeing of live tree nodes and leaving dangling pointers later accessed during document parsing. Exploitation requires local file access and active user interaction (UI:A per CVSS 4.0), no public exploit has been confirmed, but a detailed researcher blog post by the discoverer (Fatih Çelik) is publicly available and the RCE tag suggests demonstrated impact potential.

RCE Use After Free Memory Corruption +3
NVD GitHub VulDB
EPSS 1% CVSS 7.8
HIGH PATCH This Week

LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.

Command Injection Tex Live Luatex +2
NVD GitHub
EPSS 0% CVSS 5.5
MEDIUM POC PATCH This Month

LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Information Disclosure Tex Live Luatex +2
NVD
EPSS 2% CVSS 7.8
HIGH PATCH This Week

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

RCE Buffer Overflow Debian +5
NVD GitHub
EPSS 1% CVSS 8.8
HIGH This Week

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Tex Live Tug
NVD
EPSS 11% CVSS 9.8
CRITICAL POC PATCH THREAT Act Now

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 10.6%.

Information Disclosure Debian Debian Linux +4
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy