CVE-2026-63729

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63729
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63729.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63729
Downstream
Published
2026-07-21T01:35:41.899Z
Modified
2026-07-22T08:04:26.661925Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File
Details

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63729.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "TeX Live 2025"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/tex-live/texlive-source

Affected ranges

Type
GIT
Repo
https://github.com/tex-live/texlive-source
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
002dcd3eac30db5c352f53d4181737961cc7ee9a
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

Other
build-svn50573
build-svn50687
build-svn50777
build-svn50838
build-svn50882
pretest-build-20190228
pretest-build-20190307
pretest-build-20190312
pretest-build-svn50419
pretest-build-svn50430
r62569
svn50904
svn51092
svn53987
svn54259
svn54337
svn54408
svn54456
svn57874
svn58132
svn58361
svn58431
svn58528
svn58833
svn58837
svn62180
svn62182
svn62297
svn62388
svn62529
svn62544
svn62591
svn62653
svn65870
svn66081
svn66508
svn66539
svn69767
svn69767b
svn69770
svn69773
svn69778
svn69815
svn70263
svn70285
svn70406
svn70431
svn70487
svn70500
svn70551
svn70552
svn70567
svn73771
svn73908
svn74048
svn74095
svn74112
svn74153
svn74361
svn74504
svn77609
svn77745
svn77897
svn77965
svn78021
texlive-2018.*
texlive-2018.0

Database specific

vanir_signatures 
[
    {
        "digest": {
            "length": 198.0,
            "function_hash": "121387933641489108124302864517853389478"
        },
        "signature_version": "v1",
        "source": "https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a",
        "signature_type": "Function",
        "target": {
            "function": "_synctex_free_node",
            "file": "texk/web2c/synctexdir/synctex_parser.c"
        },
        "id": "CVE-2026-63729-088f9a20",
        "deprecated": false
    },
    {
        "digest": {
            "length": 164.0,
            "function_hash": "15645277229190487318491780588187520044"
        },
        "signature_version": "v1",
        "source": "https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a",
        "signature_type": "Function",
        "target": {
            "function": "_synctex_free_leaf",
            "file": "texk/web2c/synctexdir/synctex_parser.c"
        },
        "id": "CVE-2026-63729-11fe1400",
        "deprecated": false
    },
    {
        "digest": {
            "length": 361.0,
            "function_hash": "311753762499122575376331284502015693136"
        },
        "signature_version": "v1",
        "source": "https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a",
        "signature_type": "Function",
        "target": {
            "function": "_synctex_post_process_ref",
            "file": "texk/web2c/synctexdir/synctex_parser.c"
        },
        "id": "CVE-2026-63729-7c780149",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "134784100660891033311371474205321530100",
                "139759690503169970590720076022020568762",
                "336358598549248842533305888370209485727",
                "122052318861836330951565073801335727810",
                "195000724521589966068106080680520989465",
                "277506988175509270554170281566602130429",
                "327007757019526268329960456484154441841",
                "217602491223929101488238518517892594952",
                "79910622192875238226083166402010964848",
                "138793327750411863113748809062090337956",
                "264129152875749384105511823537199740353",
                "122052318861836330951565073801335727810",
                "41903845615338752948500163373420527959",
                "199238158216491960083008974325129042239",
                "268967799970453992192573408118041386285",
                "214155950842980569392995029920831021958",
                "225434404697531273024362141827533806127",
                "326163525541177139495997479153721622848",
                "122052318861836330951565073801335727810",
                "285188597816193559352696163511784760305",
                "289476773606683165103802060145674659209",
                "880451813427028491497904788752006902",
                "26119726301131591232392010997876865588",
                "32263038807851844681189512908731009673",
                "146405971274187178020954771264176313918",
                "138035169848441241145657175118710083518"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a",
        "signature_type": "Line",
        "target": {
            "file": "texk/web2c/synctexdir/synctex_parser.c"
        },
        "id": "CVE-2026-63729-afe564bd",
        "deprecated": false
    },
    {
        "digest": {
            "length": 189.0,
            "function_hash": "87530518094079038522523298463963855941"
        },
        "signature_version": "v1",
        "source": "https://github.com/tex-live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a",
        "signature_type": "Function",
        "target": {
            "function": "_synctex_free_input",
            "file": "texk/web2c/synctexdir/synctex_parser.c"
        },
        "id": "CVE-2026-63729-f0b1d830",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-07-22T08:04:26Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63729.json"