CVE-2026-63729

EUVD-2026-46144

21.07.2026, 03:16

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.6 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 2.21%

Debian Releases

Debian Product

Codename

okular

bookworm	unimportant
bookworm (security)	unimportant
forky	unimportant
sid	unimportant
trixie	unimportant
trixie (security)	unimportant

texlive-bin

bookworm	unimportant
forky	2026.20260303.78225+ds-4 fixed
sid	2026.20260303.78225+ds-5 fixed
trixie	unimportant

texstudio

bookworm	unimportant
forky	4.9.7+ds-1 fixed
sid	4.9.7+ds-1 fixed
trixie	unimportant

Ubuntu Releases

Ubuntu Product

Codename

texlive-bin

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

evince

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-devel

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-lang

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-plugin-djvudocument

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-plugin-dvidocument

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-plugin-pdfdocument

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-plugin-psdocument

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-plugin-tiffdocument

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

evince-plugin-xpsdocument

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

libevdocument3-4

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

libevview3-3

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

libkpathsea6

suse enterprise desktop 15 SP7	6.3.3-150600.38.3.1 fixed
suse enterprise sap 15 SP7	6.3.3-150600.38.3.1 fixed
suse enterprise server 15 SP4	6.3.3-150400.31.9.1 fixed
suse enterprise server 15 SP7	6.3.3-150600.38.3.1 fixed

libptexenc1

suse enterprise desktop 15 SP7	1.3.9-150600.38.3.1 fixed
suse enterprise sap 15 SP7	1.3.9-150600.38.3.1 fixed
suse enterprise server 15 SP4	1.3.9-150400.31.9.1 fixed
suse enterprise server 15 SP7	1.3.9-150600.38.3.1 fixed

libsynctex2

suse enterprise desktop 15 SP7	1.21-150600.38.3.1 fixed
suse enterprise sap 15 SP7	1.21-150600.38.3.1 fixed
suse enterprise server 15 SP4	1.21-150400.31.9.1 fixed
suse enterprise server 15 SP7	1.21-150600.38.3.1 fixed

libtexlua53-5

suse enterprise desktop 15 SP7	5.3.6-150600.38.3.1 fixed
suse enterprise sap 15 SP7	5.3.6-150600.38.3.1 fixed
suse enterprise server 15 SP4	5.3.6-150400.31.9.1 fixed
suse enterprise server 15 SP7	5.3.6-150600.38.3.1 fixed

nautilus-evince

suse enterprise server 15 SP4

41.4-150400.3.9.1

fixed

texlive

suse enterprise desktop 15 SP7	2021.20210325-150600.38.3.1 fixed
suse enterprise sap 15 SP7	2021.20210325-150600.38.3.1 fixed
suse enterprise server 15 SP4	2021.20210325-150400.31.9.1 fixed
suse enterprise server 15 SP7	2021.20210325-150600.38.3.1 fixed

texlive-bin-devel

suse enterprise desktop 15 SP7	2021.20210325-150600.38.3.1 fixed
suse enterprise sap 12 SP5	2013.20130620-22.14.1 fixed
suse enterprise sap 15 SP7	2021.20210325-150600.38.3.1 fixed
suse enterprise server 12 SP5	2013.20130620-22.14.1 fixed
suse enterprise server 15 SP4	2021.20210325-150400.31.9.1 fixed
suse enterprise server 15 SP7	2021.20210325-150600.38.3.1 fixed

texlive-kpathsea-devel

suse enterprise desktop 15 SP7	6.3.3-150600.38.3.1 fixed
suse enterprise sap 15 SP7	6.3.3-150600.38.3.1 fixed
suse enterprise server 15 SP4	6.3.3-150400.31.9.1 fixed
suse enterprise server 15 SP7	6.3.3-150600.38.3.1 fixed

texlive-ptexenc-devel

suse enterprise desktop 15 SP7	1.3.9-150600.38.3.1 fixed
suse enterprise sap 15 SP7	1.3.9-150600.38.3.1 fixed
suse enterprise server 15 SP4	1.3.9-150400.31.9.1 fixed
suse enterprise server 15 SP7	1.3.9-150600.38.3.1 fixed

texlive-synctex-devel

suse enterprise desktop 15 SP7	1.21-150600.38.3.1 fixed
suse enterprise sap 15 SP7	1.21-150600.38.3.1 fixed
suse enterprise server 15 SP4	1.21-150400.31.9.1 fixed
suse enterprise server 15 SP7	1.21-150600.38.3.1 fixed

texlive-texlua-devel

suse enterprise desktop 15 SP7	5.3.6-150600.38.3.1 fixed
suse enterprise sap 15 SP7	5.3.6-150600.38.3.1 fixed
suse enterprise server 15 SP4	5.3.6-150400.31.9.1 fixed
suse enterprise server 15 SP7	5.3.6-150600.38.3.1 fixed

typelib-1_0-EvinceDocument-3_0

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

typelib-1_0-EvinceView-3_0

suse enterprise desktop 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise sap 15 SP7	45.0-150600.3.6.1 fixed
suse enterprise server 15 SP4	41.4-150400.3.9.1 fixed
suse enterprise server 15 SP7	45.0-150600.3.6.1 fixed

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://fatihhcelik.github.io/posts/evince-synctex-heap-use-after-free/

https://github.com/TeX-Live/texlive-source/

https://github.com/TeX-Live/texlive-source/commit/002dcd3eac30db5c352f53d4181737961cc7ee9a

https://www.vulncheck.com/advisories/tex-live-synctex-parser-heap-use-after-free-via-malformed-synctex-file