Live › vulnerability › CVE-2026-55543
Go to dashboardTuxGuitar, an open-source guitar tablature editor, loads a class named inside a crafted .tg file through an unverified class loader when the file is opened. An attacker who gets a user to open that file runs code with the privileges of the TuxGuitar process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who runs TuxGuitar before 2.1.0 and opens .tg files from outside their own team. The flaw sits in the soundbank loading path, so a user who never opens untrusted files is not reached. Teams that only use TuxGuitar on files they authored can treat it as lower risk, but should still upgrade.
No product ranges from the sources yet.
2.1.0.2.1.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-55543")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.