Vulnerability · Published Oct 16, 2026 · Assigned by GitHub_M
CVE-2026-55543TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file
High 8.5
In plain English
A high-severity code injection in tuxguitar from helge17. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tuxguitar | no fix listed | DEBIAN-CVE-2026-55543 |
| Debian:13 | tuxguitar | no fix listed | DEBIAN-CVE-2026-55543 |
| Debian:14 | tuxguitar | no fix listed | DEBIAN-CVE-2026-55543 |
| Ubuntu:22.04:LTS | tuxguitar | no fix listed | UBUNTU-CVE-2026-55543 |
| Ubuntu:24.04:LTS | tuxguitar | no fix listed | UBUNTU-CVE-2026-55543 |
| Ubuntu:26.04:LTS | tuxguitar | no fix listed | UBUNTU-CVE-2026-55543 |
| Ubuntu:26.10 | tuxguitar | no fix listed | UBUNTU-CVE-2026-55543 |
Affected products (as reported)
Weakness: CWE-94, CWE-470 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/helge17/tuxguitar/security/advisories/GHSA-v66p-c82h-w3cq x_refsource_CONFIRM
- https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636 x_refsource_MISC
- https://github.com/helge17/tuxguitar/releases/tag/2.1.0 x_refsource_MISC