Heap Use-After-Free Vulnerability in texlive-bin Package
Summary
DEBIAN-CVE-2026-63729: The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentiall... Affects texlive-bin versions 2020.20200327.54578-7 – 2026.20260303.78225+ds-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The texlive-bin package is part of the TeX Live distribution, which provides a comprehensive suite of tools for typesetting documents using the TeX typesetting system. It is widely used in academia and publishing for its powerful capabilities in handling complex documents. However, the package has been found to contain a critical vulnerability in its SyncTeX parser, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability arises from a heap use-after-free issue in the SyncTeX parser (synctex_parser.c) included with TeX Live. Attackers can exploit this flaw by supplying a malformed .synctex or .synctex.gz file, which can cause applications to crash or potentially execute arbitrary code. The vulnerability occurs when a ref node is constructed with a NULL parent pointer, leading to a failure in detaching the node from its sibling chain. This triggers recursive freeing of live tree nodes, resulting in dangling pointers that the parser may access during document loading.
How To Fix
No fixed version is published for this vulnerability.
To rectify the vulnerability, it is recommended to update the texlive-bin package to the patched version. The fixed version is 2026.20260303.78225+ds-2. You can update the package using the following command in your terminal:
sudo apt-get update && sudo apt-get install texlive-bin=2026.20260303.78225+ds-2.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid opening or processing .synctex or .synctex.gz files from untrusted sources until the package is updated.
Conclusion
The texlive-bin package has a critical heap use-after-free vulnerability that can be exploited through malformed SyncTeX files. It is crucial to update to the patched version to safeguard against potential attacks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for texlive-bin →
FAQ
A heap use-after-free vulnerability occurs when a program continues to use a memory area after it has been freed, potentially allowing attackers to manipulate the program's execution flow.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in your software.
Exploitation of this vulnerability can lead to application crashes or arbitrary code execution, posing significant security risks.
Yes, a patched version of the texlive-bin package is available. Update to version 2026.20260303.78225+ds-2 to mitigate the vulnerability.
If an immediate update is not possible, refrain from using .synctex or .synctex.gz files from untrusted sources as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for texlive-bin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.