CVE-2026-55543
Received Received - Intake

Code Execution via Malicious .tg File in TuxGuitar

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-55543
EUVD
EUVD-2026-102925

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
helge17 tuxguitar < 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

TuxGuitar versions before 2.1.0 are vulnerable to arbitrary code execution via malicious .tg files. An attacker can embed a harmful Java class inside a .tg file, which executes automatically when the victim opens it. The vulnerability stems from improper handling of the gervil.soundbank.path parameter in the file's content.xml, allowing the file to reference itself as a soundbank. The JARSoundbankReader then loads and runs the specified class without verification, leading to code execution during class construction.

Detection Guidance

This vulnerability involves malicious .tg files exploiting the gervil.soundbank.path parameter. To detect it, inspect .tg files for unusual content.xml entries or embedded .class files. Check for files referencing themselves as soundbanks. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code on your system with the privileges of the TuxGuitar process. This could lead to system compromise, data theft, or installation of malware. The attack requires minimal user interaction, as opening a malicious .tg file is sufficient. It impacts confidentiality, integrity, and availability of the affected system.

Compliance Impact

This vulnerability could lead to arbitrary code execution when processing malicious .tg files, potentially allowing attackers to access, modify, or exfiltrate sensitive data. For GDPR, this may result in unauthorized data processing or breaches. For HIPAA, it could expose protected health information. The impact depends on the data processed by TuxGuitar and the attacker's access level.

Mitigation Strategies

Upgrade TuxGuitar to version 2.1.0 or later to remove the vulnerable JARSoundbankReader class. Avoid opening untrusted .tg files. If using older versions, disable the JARSoundbankReader functionality manually if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart