CVE-2026-55543

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55543
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55543.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55543
Aliases
  • GHSA-v66p-c82h-w3cq
Downstream
Related
Published
2026-10-16T15:28:14Z
Modified
2026-10-30T07:21:40Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file
Details

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-470",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55543.json"
}
References

Affected packages

Git / github.com/helge17/tuxguitar

Affected ranges

Type
GIT
Repo
https://github.com/helge17/tuxguitar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2c46e2a1cccdfdfa6e6f2692f241bd60bf418129
Fixed
a7eef20e2e02ee454597d42c295327d9f098c636
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.1.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "a7eef20e2e02ee454597d42c295327d9f098c636"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "2.1.0",
            "range": [
                {
                    "fixed": "2c46e2a1cccdfdfa6e6f2692f241bd60bf418129"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.6.0
1.6.1
2.*
2.0.0
2.0.1
2.0.1-swt4.26-legacy

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55543.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "58202507018161542584395143985856689139",
            "length": 138
        },
        "id": "CVE-2026-55543-12f8f403",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "android/TuxGuitar-android-gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "getSoundbank"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "13306741366290276871895053289134315670",
            "length": 94
        },
        "id": "CVE-2026-55543-16f39200",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "desktop/gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "getSoundbank"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177020866233323888131067963104942583288",
                "53986970093291337221256272384139676263",
                "44410977465853094606633497537384977802",
                "247971480906935771389633919880647986274",
                "11549580947763972195047024331795665622",
                "318809993622177162917405536601871391307",
                "322877967687365855498276316614710632785",
                "145289739291815825080553879770004133962",
                "299900236838990614280958014361046100701",
                "218494458488963482988654706027209053817",
                "285125396083955258586598758498029108436",
                "192512714479938589905025753470430523591",
                "194341182497759349843367362340596299426",
                "214400552898049450471383702252421060630",
                "250461768332263024412918220366411277327",
                "176347175995448654340788673661190093731",
                "173230399253806071827878259563699813119",
                "195785903407735751285833109907737941441",
                "158234989810377622459390138785534528015",
                "51532030684460672798173906255134404356",
                "318013376162450691007764901988032948449",
                "187538978826229997798630122753448006917",
                "163425414312238434765459596692042725312",
                "188028782073539251064991391300962019376",
                "198481456257823144403933934460604686475",
                "71520620329088469406841554369355361640",
                "129189033393372323796342044964245809801",
                "116323133784507131549841347251756069039",
                "193471406415449787068728736859909260275",
                "310967129156535228461084686010072361408",
                "309632394299608290705240057179891125548",
                "291689270439847522663832708919818714631",
                "178164845284164032610158298314209998779",
                "315507863393841891076055456414520870668",
                "260422376328657982151799317792854137498",
                "247531546064913750763906499675042814992",
                "15813401174090895932659700261113655541",
                "145238880230605890523311690082711666627",
                "109581876604274654894668882902053429242",
                "165230305917268580093821423391636166698",
                "162148871641656311354409750845570214240",
                "63799069650747156169377797659530107418",
                "243893363537932544900855034966830843992",
                "28092560785421285060678265982951095603",
                "114412347781909878715125487624403397910",
                "35714130978925967968976412276358871687",
                "75280227203275720488569419959526311849",
                "27697513959781418046477675229756950868",
                "23470390011109669303918902400319114958",
                "223110022440911206663230726557814616520",
                "234076820886546624089715131283003134144",
                "243116286619332265989561731630606021606",
                "43378176119815613613987400289713983195",
                "244979140649858443164903204910540509604",
                "187139470646370126659209426981709943585",
                "197323542292739137904227729979774939934",
                "304264644837744601659443257104962122056",
                "290808032837377270767298425085119546002",
                "125606337441993533217853832406903456048",
                "306591860953130787492516488549278910723",
                "169661155947791146310247346962634624883",
                "273817096940443635264084799447110077712",
                "211713289833637081480473614967632448412",
                "259710086026560925074355848184343196931",
                "338367452732793127475779509691527482415",
                "95638027062281630935898966030954596462",
                "274052003245334758762921479083341707547",
                "228249174724803873886659218715309916917",
                "234850577779536540057081713732738766745",
                "80365934000840904606243492943057912332",
                "281220327364513071200445671158164280560",
                "241078513240216061782793123143514015386",
                "304618980049456546156485875272199576468",
                "299081197050291182548356281121774687329",
                "266683902844879274135025091993597086505",
                "189853051195014032153476772279600053165",
                "308752703912221841347152971051827797128",
                "159744167114102881681904784671144326393",
                "34127761338353371387982579858586636732",
                "79827920419153848264286879072125209176",
                "210388244364992709208924297336571648616",
                "31583221014865183284363906247966058699",
                "224944961367091625957480163354144298971",
                "243253544900351012566674750547385916540",
                "309070658492532308803905468379876378601"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55543-35b0aaff",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "desktop/gervill/src/main/java/media/sound/JARSoundbankReader.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "58202507018161542584395143985856689139",
            "length": 138
        },
        "id": "CVE-2026-55543-4c37ea7d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "desktop/gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "getSoundbank"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24952538126320392307216890104051017694",
            "length": 356
        },
        "id": "CVE-2026-55543-4c3d7289",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "desktop/gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "isZIP"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "296046595769588772317467598815646821719",
            "length": 1034
        },
        "id": "CVE-2026-55543-73236975",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "android/TuxGuitar-android-gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "getSoundbank"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "13306741366290276871895053289134315670",
            "length": 94
        },
        "id": "CVE-2026-55543-8396d5b7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "android/TuxGuitar-android-gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "getSoundbank"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "296046595769588772317467598815646821719",
            "length": 1034
        },
        "id": "CVE-2026-55543-88bd4316",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "desktop/gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "getSoundbank"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24952538126320392307216890104051017694",
            "length": 356
        },
        "id": "CVE-2026-55543-c408dc01",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "android/TuxGuitar-android-gervill/src/main/java/media/sound/JARSoundbankReader.java",
            "function": "isZIP"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177020866233323888131067963104942583288",
                "53986970093291337221256272384139676263",
                "44410977465853094606633497537384977802",
                "247971480906935771389633919880647986274",
                "11549580947763972195047024331795665622",
                "318809993622177162917405536601871391307",
                "322877967687365855498276316614710632785",
                "145289739291815825080553879770004133962",
                "299900236838990614280958014361046100701",
                "218494458488963482988654706027209053817",
                "285125396083955258586598758498029108436",
                "192512714479938589905025753470430523591",
                "194341182497759349843367362340596299426",
                "214400552898049450471383702252421060630",
                "250461768332263024412918220366411277327",
                "176347175995448654340788673661190093731",
                "173230399253806071827878259563699813119",
                "195785903407735751285833109907737941441",
                "158234989810377622459390138785534528015",
                "51532030684460672798173906255134404356",
                "318013376162450691007764901988032948449",
                "187538978826229997798630122753448006917",
                "163425414312238434765459596692042725312",
                "188028782073539251064991391300962019376",
                "198481456257823144403933934460604686475",
                "71520620329088469406841554369355361640",
                "129189033393372323796342044964245809801",
                "116323133784507131549841347251756069039",
                "193471406415449787068728736859909260275",
                "310967129156535228461084686010072361408",
                "309632394299608290705240057179891125548",
                "291689270439847522663832708919818714631",
                "178164845284164032610158298314209998779",
                "315507863393841891076055456414520870668",
                "260422376328657982151799317792854137498",
                "247531546064913750763906499675042814992",
                "15813401174090895932659700261113655541",
                "145238880230605890523311690082711666627",
                "109581876604274654894668882902053429242",
                "165230305917268580093821423391636166698",
                "162148871641656311354409750845570214240",
                "63799069650747156169377797659530107418",
                "243893363537932544900855034966830843992",
                "28092560785421285060678265982951095603",
                "114412347781909878715125487624403397910",
                "35714130978925967968976412276358871687",
                "75280227203275720488569419959526311849",
                "27697513959781418046477675229756950868",
                "23470390011109669303918902400319114958",
                "223110022440911206663230726557814616520",
                "234076820886546624089715131283003134144",
                "243116286619332265989561731630606021606",
                "43378176119815613613987400289713983195",
                "244979140649858443164903204910540509604",
                "187139470646370126659209426981709943585",
                "197323542292739137904227729979774939934",
                "304264644837744601659443257104962122056",
                "290808032837377270767298425085119546002",
                "125606337441993533217853832406903456048",
                "306591860953130787492516488549278910723",
                "169661155947791146310247346962634624883",
                "273817096940443635264084799447110077712",
                "211713289833637081480473614967632448412",
                "259710086026560925074355848184343196931",
                "338367452732793127475779509691527482415",
                "95638027062281630935898966030954596462",
                "274052003245334758762921479083341707547",
                "228249174724803873886659218715309916917",
                "234850577779536540057081713732738766745",
                "80365934000840904606243492943057912332",
                "281220327364513071200445671158164280560",
                "241078513240216061782793123143514015386",
                "304618980049456546156485875272199576468",
                "299081197050291182548356281121774687329",
                "266683902844879274135025091993597086505",
                "189853051195014032153476772279600053165",
                "308752703912221841347152971051827797128",
                "159744167114102881681904784671144326393",
                "34127761338353371387982579858586636732",
                "79827920419153848264286879072125209176",
                "210388244364992709208924297336571648616",
                "31583221014865183284363906247966058699",
                "224944961367091625957480163354144298971",
                "243253544900351012566674750547385916540",
                "309070658492532308803905468379876378601"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55543-fdf40609",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636",
        "target": {
            "file": "android/TuxGuitar-android-gervill/src/main/java/media/sound/JARSoundbankReader.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-30T07:21:40Z"