CVE-2026-55543

high

Description

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

References

https://github.com/helge17/tuxguitar/security/advisories/GHSA-v66p-c82h-w3cq

https://github.com/helge17/tuxguitar/releases/tag/2.1.0

https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102925

Details

Source: Mitre, NVD

Published: 2026-10-16

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 7.3

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.5

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High