Approved changes feed: RSS · Atom
cpe:2.3:a:tex_live:tex_live:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Tex Live (18e91435-569c-5120-bbd6-5c2e22141ea0) |
|---|---|
| Product | Tex Live (ed5cb91b-a5c8-5137-8f6d-247d871fff3a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-63729 |
vulnerable | 2026-07-29 01:06:19.442604 |
TeX Live SyncTeX Parser Heap Use-After-Free via Malformed SyncTeX File
MEDIUM (6.6)
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
Published: 2026-07-21T01:35:41.899Z
Updated: 2026-09-24T14:18:09.221Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.