{"id":"CVE-2026-55543","kind":"vulnerability","aliases":["CVE-2026-55543"],"related":[],"title":"TuxGuitar: opening a crafted .tg file runs attacker code","description":"TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.","summary":"TuxGuitar, an open-source guitar tablature editor, loads a class named inside a crafted .tg file through an unverified class loader when the file is opened. An attacker who gets a user to open that file runs code with the privileges of the TuxGuitar process.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","linux","macos","music-software","package","tuxguitar","windows"],"not_affected_if":["only-trusted-files","version-2.1.0-or-later"],"how_to_check":"- Run the TuxGuitar launcher or check the installed package version; affected builds are earlier than `2.1.0`.\n- Check the installed version of the TuxGuitar package on each workstation that opens tablature files.","fix":"- Upgrade TuxGuitar to `2.1.0` or later.\n- Until upgraded, open only .tg files from trusted sources.","status":"open","published_at":"2026-10-16T16:18:43+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:01:36+00:00","updated_at":"2026-10-25T03:01:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:01:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TuxGuitar to `2.1.0` or later.\n- Until upgraded, open only .tg files from trusted sources.","reach":"local","title":"TuxGuitar: opening a crafted .tg file runs attacker code","impact":"high","summary":"TuxGuitar, an open-source guitar tablature editor, loads a class named inside a crafted .tg file through an unverified class loader when the file is opened. An attacker who gets a user to open that file runs code with the privileges of the TuxGuitar process.","category":"package","nicknames":[],"who_cares":["tuxguitar","desktop","music-software","linux","windows","macos"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker code runs with the privileges of the TuxGuitar user.","analyst_note":"","how_to_check":"- Run the TuxGuitar launcher or check the installed package version; affected builds are earlier than `2.1.0`.\n- Check the installed version of the TuxGuitar package on each workstation that opens tablature files.","needs_analyst":false,"not_affected_if":["version-2.1.0-or-later","only-trusted-files"],"who_is_affected":"Anyone who runs TuxGuitar before 2.1.0 and opens .tg files from outside their own team. The flaw sits in the soundbank loading path, so a user who never opens untrusted files is not reached. Teams that only use TuxGuitar on files they authored can treat it as lower risk, but should still upgrade.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000614,"input_tokens":3388,"output_tokens":551,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-55543':12A,15A '/services/javax.sound.midi.soundbank':106C '2.1.0':82C,152C 'archiv':96C,117C 'attack':8A,53B,111C 'attacker-suppli':110C 'class':35B,45B,113C,128C,135C 'code':9A,63B 'constructor':138C 'craft':4A,39B 'cve':10A,13A 'desktop':16B 'disk':95C 'editor':32B,79C 'entri':107C 'execut':136C 'file':6A,41B,49B,61B,86C,100C,123C 'fix':149C 'gervil.soundbank.path':89C 'get':55B 'guitar':30B,77C 'includ':97C 'inf':105C 'insid':37B 'instanti':133C 'issu':147C 'jarsoundbankread':124C 'linux':17B 'load':33B,131C 'loader':46B,129C 'maco':18B 'meta':104C 'meta-inf':103C 'music':20B 'music-softwar':19B 'name':36B,108C 'on-disk':93C 'open':2A,28B,51B,59B,75C,121C 'open-sourc':27B,74C 'packag':22B 'prior':80C 'privileg':66B,141C 'process':70B,145C 'refer':91C 'run':7A,62B 'set':88C 'softwar':21B 'sourc':29B,76C 'store':114C 'suppli':112C 'tablatur':31B,78C 'tg':5A,40B,85C,99C 'tuxguitar':1A,23B,25B,69B,71C,144C 'untrust':84C 'unverifi':44B,127C 'use':125C 'user':57B,120C 'version':151C 'whose':102C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs TuxGuitar before 2.1.0 and opens .tg files from outside their own team. The flaw sits in the soundbank loading path, so a user who never opens untrusted files is not reached. Teams that only use TuxGuitar on files they authored can treat it as lower risk, but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55543","severity":null,"published_at":"2026-10-16T16:18:43+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}