The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as     GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or     potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed     SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail     to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves     dangling pointers that are later accessed by the parser during document load. (CVE-2026-63729)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63729

medium Nessus Plugin ID 329530

Version 1.5

Version 1.4

Version 1.2

Version 1.1

Version 1.5 Aug 7, 2026, 9:55 PM Detection (updated detection logic) Plugin Feed: 202608072155
Version 1.4 Aug 6, 2026, 3:43 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:P") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608061543
Version 1.2 Aug 1, 2026, 6:58 AM Plugin metadata CVSSv2 severity (based on CVE-2026-63729, severity increased from "Medium" to "High") CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:C/I:P/A:P") CVSS metrics ("CVSSv2 score" set to 8.3) Detection (updated detection logic) Plugin Feed: 202608010658
Version 1.1 Jul 25, 2026, 1:06 PM New Plugin Feed: 202607251306