The SyncTeX parser in TeX Live is responsible for translating document positions between source and compiled output. A malformed .synctex or .synctex.gz file can create a ref node with a null parent pointer. The parser then fails to detach the node from its sibling chain, leading to recursive freeing of live tree nodes. This results in dangling pointers that are later accessed during document load, causing a heap use‑after‑free. Depending on the trigger and the environment, the vulnerability can lead to application crashes or the execution of arbitrary code.

The vulnerability exists in the TeX Live distribution and is inherited by downstream consumers that embed the same parser, such as GNOME Evince. Any system running a susceptible TeX Live version that processes .synctex files—whether in editing tools, PDF viewers, or document generators—is potentially affected. Specific affected versions were not disclosed in the provided data.

The CVSS score of 6.8 indicates medium severity. The EPSS score of less than 1 % suggests a low probability of exploitation at the time of this analysis, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted SyncTeX file to a user’s application; therefore the attack vector is likely local or via a privileged user who can provide the malicious file. While the description does not confirm remote exploitation, the presence of a code‑execution possibility elevates the risk for any environment that accepts untrusted SyncTeX documents.