What is CVE-2026-63729?

CVE-2026-63729 is a medium-severity vulnerability in Tex Live, classified under Use After Free. CVSS score: 6.6/10. Published 2026-07-21.

How severe is CVE-2026-63729?

Medium severity. CVSS v3 base score is 6.6 out of 10.

Use After Free in Tex Live

CVE-2026-63729

The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary…

Vulnerability class: Use-After-Free

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H.

Affected products

Tex Live — versions 0, TeX Live 2026

Weakness classification (CWE)

CWE-416 — Use After Free

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-63729?: CVE-2026-63729 is a medium-severity vulnerability in Tex Live, classified under Use After Free. CVSS score: 6.6/10. Published 2026-07-21.
How severe is CVE-2026-63729?: Medium severity. CVSS v3 base score is 6.6 out of 10.