CVE-2026-55543

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55543
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55543.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55543
Aliases
  • GHSA-v66p-c82h-w3cq
Downstream
Related
Published
2026-10-16T15:28:14Z
Modified
2026-10-17T02:47:16Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file
Details

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-470",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55543.json"
}
References

Affected packages

Git / github.com/helge17/tuxguitar

Affected ranges

Type
GIT
Repo
https://github.com/helge17/tuxguitar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2c46e2a1cccdfdfa6e6f2692f241bd60bf418129
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.1.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.6.0
1.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55543.json"