CVE-2026-63729
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.6 / 10
Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Vulnerability Description
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-416
Source
NVD
Vendor
TeX Live
Product
TeX Live
External References
- https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/
- https://github.com/TeX-Live/texlive-source/
- https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a
- https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file
Discussion (0)
Add Comment
No comments yet. Be the first!