CVE-2026-55543: TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

Q: Who is exposed to this issue?

Users running TuxGuitar versions earlier than 2.1.0 are exposed when they open an untrusted .tg file. The attacker-controlled code runs with the privileges of the TuxGuitar process.

Q: What must an attacker do to exploit it?

An attacker must persuade a user to open a specially crafted .tg file. The file can point gervil.soundbank.path at an on-disk archive, including itself, and use a Soundbank service entry to cause an attacker-supplied class to be loaded and instantiated.

Q: How can this be remediated?

Upgrade TuxGuitar to version 2.1.0, which fixes the issue. Until upgrading is possible, do not open .tg files from untrusted sources.

Published Oct 16, 2026

Updated

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

Affected Software

1 affected component

TuxGuitar TuxGuitar<2.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TuxGuitar to a version that resolves this vulnerability.
Fixed in 2.1.0

Event History

Oct 16, 2026

CVE Published

via MITRE·03:28 PM

Data Sourced

via MITRE·03:28 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users running TuxGuitar versions earlier than 2.1.0 are exposed when they open an untrusted .tg file. The attacker-controlled code runs with the privileges of the TuxGuitar process.

What must an attacker do to exploit it?

An attacker must persuade a user to open a specially crafted .tg file. The file can point gervil.soundbank.path at an on-disk archive, including itself, and use a Soundbank service entry to cause an attacker-supplied class to be loaded and instantiated.

How can this be remediated?

Upgrade TuxGuitar to version 2.1.0, which fixes the issue. Until upgrading is possible, do not open .tg files from untrusted sources.

CVE-2026-55543: TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

How can this be remediated?