CVE-2026-55543 TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file
Attackers can execute arbitrary code by tricking users into opening a malicious .tg file that loads an unverified class from an embedded archive.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55543?
CVE-2026-55543 is a high-severity code injection vulnerability in helge17 tuxguitar, published on 16 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.
Which versions are affected by CVE-2026-55543?
Linux distribution packages (1)
tuxguitar openSUSE:Tumbleweed | All versions | 2.1.0-1.1 |
How do I fix CVE-2026-55543?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-55543 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55543 exists.
Sources
Also known as DEBIAN-CVE-2026-55543, GHSA-v66p-c82h-w3cq, UBUNTU-CVE-2026-55543, openSUSE-SU-2026:11645-1.