CVE-2026-63729: SyncTeX Parser Use-After-Free Vulnerability

CVE-2026-63729 Overview

CVE-2026-63729 is a heap use-after-free vulnerability [CWE-416] in the SyncTeX parser (synctex_parser.c) shipped with TeX Live. The flaw affects downstream consumers that embed the parser, including GNOME Evince. Attackers can crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. The vulnerability occurs when a ref node with a NULL parent pointer causes the replacement routine to skip detachment from its sibling chain. Subsequent recursive freeing operations then walk into live tree nodes, leaving dangling pointers that the parser later dereferences during document load.

Critical Impact

A malformed SyncTeX file opened in a vulnerable application triggers heap use-after-free conditions that can lead to application crashes or arbitrary code execution in the context of the current user.

Affected Products

• TeX Live (versions shipping synctex_parser.c prior to commit 002dcd3eac30db5c352f53d4181737961cc7ee9a)
• GNOME Evince document viewer (embeds the SyncTeX parser)
• Downstream consumers of the TeX Live SyncTeX parser library

Discovery Timeline

• 2026-02-15 - Vulnerability reported by Fatih Çelik via tlsecurity
• 2026-02-23 - Patch authored by Norbert Preining in the TeX Live source repository
• 2026-07-21 - CVE-2026-63729 published to NVD
• 2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63729

Vulnerability Analysis

The vulnerability resides in _synctex_post_process_ref() at synctex_parser.c:5799. The function calls __synctex_replace_ref(ref) to replace a ref node with a proxy node in the parse tree. Detachment from the sibling chain happens only when the ref has a valid parent pointer. When _synctex_tree_parent(ref) returns NULL, the error path executes without resetting the sibling pointer. The parser then invokes synctex_node_free(ref) unconditionally, which calls _synctex_free_leaf(ref). This routine recursively frees the sibling chain, but that chain still belongs to the live tree.

Root Cause

The root cause is missing pointer hygiene in the node-free routines. _synctex_free_node, _synctex_free_leaf, and _synctex_free_input recursively free sibling and child nodes without first detaching them. When a caller frees a partially-detached node, the free cascade walks into live tree memory and releases it, producing dangling references later dereferenced by the parser.

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts a malformed .synctex or .synctex.gz file that constructs a ref node without a parent. The victim opens an associated PDF or DVI document in a viewer such as GNOME Evince, which loads the SyncTeX file automatically. The parser triggers the free cascade during document load, corrupting the heap and creating conditions for code execution.

/* Patch from TeX Live commit 002dcd3eac30db5c352f53d4181737961cc7ee9a */
static void _synctex_free_node(synctex_node_p node) {
    if (node) {
        synctex_node_p sibling;
        synctex_node_p child;
        SYNCTEX_SCANNER_REMOVE_HANDLE_TO(node);
        SYNCTEX_WILL_FREE(node);
        sibling = __synctex_tree_reset_sibling(node);
        child = _synctex_tree_reset_child(node);
        synctex_node_free(sibling);
        synctex_node_free(child);
        _synctex_free(node);
    }
    return;
}

Source: TeX Live commit 002dcd3 — the fix resets sibling and child pointers before recursive freeing.

Detection Methods for CVE-2026-63729

Indicators of Compromise

• Unexpected crashes of evince or other SyncTeX-consuming processes when opening PDF or DVI documents accompanied by .synctex or .synctex.gz files.
• Presence of untrusted .synctex or .synctex.gz files in user download directories or email attachment caches.
• Heap corruption signatures such as SIGSEGV or SIGABRT with backtraces referencing _synctex_free_node, _synctex_free_leaf, or _synctex_post_process_ref.

Detection Strategies

• Monitor process crash telemetry for document viewers that load SyncTeX data, correlating crashes with recently accessed files.
• Deploy AddressSanitizer (ASan) builds of Evince or TeX Live tools in test environments to catch use-after-free conditions during triage.
• Inspect .synctex files for structurally invalid node references, including ref nodes without valid parent context.

Monitoring Recommendations

• Ingest application crash logs and core dumps into a centralized data lake for analysis of recurring parser failures.
• Track file-open events for .synctex and .synctex.gz extensions across user endpoints.
• Alert on document viewer processes spawning unexpected child processes, which may indicate successful post-exploitation activity.

How to Mitigate CVE-2026-63729

Immediate Actions Required

• Apply the upstream TeX Live patch or update to a distribution package that includes commit 002dcd3eac30db5c352f53d4181737961cc7ee9a.
• Update GNOME Evince and any application that statically or dynamically links against the vulnerable SyncTeX parser.
• Instruct users not to open .synctex or .synctex.gz files received from untrusted sources or bundled with untrusted PDF/DVI documents.

Patch Information

The fix is available in the TeX Live source repository via commit 002dcd3eac30db5c352f53d4181737961cc7ee9a. The patch resets sibling and child pointers before recursive freeing in _synctex_free_node, _synctex_free_leaf, and _synctex_free_input, and ensures _synctex_post_process_ref clears the sibling pointer even when __synctex_replace_ref fails. Additional context is available in the VulnCheck Security Advisory and the researcher's technical writeup.

Workarounds

• Disable SyncTeX support in document viewers where the feature is not required for TeX editing workflows.
• Remove or rename .synctex and .synctex.gz files accompanying untrusted documents before opening them.
• Run document viewers under sandboxing frameworks such as Flatpak, bubblewrap, or Firejail to constrain the impact of successful exploitation.

# Remove companion SyncTeX files before opening an untrusted PDF
find /path/to/untrusted -type f \( -name '*.synctex' -o -name '*.synctex.gz' \) -delete

# Verify installed TeX Live package includes the fix
dpkg -l | grep texlive-binaries
apt-get update && apt-get install --only-upgrade texlive-binaries evince