CVE-2026-63729

Name	CVE-2026-63729
Description	The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
texlive-bin (PTS)	bullseye	2020.20200327.54578-7+deb11u1	vulnerable
	bullseye (security)	2020.20200327.54578-7+deb11u2	vulnerable
	bookworm	2022.20220321.62855-5.1+deb12u2	vulnerable
	trixie	2024.20240313.70630+ds-6	vulnerable
	forky, sid	2026.20260303.78225+ds-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
texlive-bin	source	(unstable)	2026.20260303.78225+ds-2

Notes

Fixed by: https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a (svn78081)
https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/