CVE catalog

CVE-2026-55543

Severity: High · CVSS 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Aug 29, 2026, 12:00:00 AM UTC
Updated: Oct 16, 2026, 4:18:43 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.15% · Oct 25, 2026

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	tuxguitar	sid	`2.0.0+dfsg1-3`	vulnerable
Debian	tuxguitar	forky	`2.0.0+dfsg1-3`	vulnerable
Debian	tuxguitar	trixie	`1.6.6+dfsg1-3`	vulnerable
Debian	tuxguitar	bookworm	`1.5.6+dfsg1-6`	vulnerable
Opensuse	tuxguitar	tumbleweed	`2.1.0-1.1`	fixed
Ubuntu	tuxguitar	16.04	`1.2-20build1`	vulnerable
Ubuntu	tuxguitar	16.04	`1.2-21`	vulnerable
Ubuntu	tuxguitar	18.04	`1.2-22`	vulnerable
Ubuntu	tuxguitar	18.04	`1.2-23`	vulnerable
Ubuntu	tuxguitar	20.04	`1.2-23`	vulnerable
Ubuntu	tuxguitar	20.04	`1.2-24`	vulnerable
Ubuntu	tuxguitar	20.04	`1.2-24ubuntu1`	vulnerable
Ubuntu	tuxguitar	20.04	`1.2-25`	vulnerable
Ubuntu	tuxguitar	20.04	`1.2-25build1`	vulnerable
Ubuntu	tuxguitar	22.04	`1.2-25build1`	vulnerable
Ubuntu	tuxguitar	22.04	`1.2-25build2`	vulnerable
Ubuntu	tuxguitar	24.04	`1.5.6+dfsg1-6`	vulnerable
Ubuntu	tuxguitar	24.04	`1.5.6+dfsg1-7`	vulnerable
Ubuntu	tuxguitar	24.04	`1.5.6+dfsg1-8`	vulnerable
Ubuntu	tuxguitar	24.04	`1.5.6+dfsg1-8build2`	vulnerable
Ubuntu	tuxguitar	24.04	`1.5.6+dfsg1-8build3`	vulnerable
Ubuntu	tuxguitar	26.10	`2.0.0+dfsg1-3`	vulnerable
Ubuntu	tuxguitar	26.04	`1.6.6+dfsg1-3`	vulnerable
Ubuntu	tuxguitar	26.04	`2.0.0+dfsg1-1`	vulnerable
Ubuntu	tuxguitar	26.04	`2.0.0+dfsg1-2`	vulnerable
Ubuntu	tuxguitar	26.04	`2.0.0+dfsg1-3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	tuxguitar	source	sid	`(unfixed)`	not yet assigned	Not reported	[1151103]
Debian	tuxguitar	source	forky	`(unfixed)`	not yet assigned	Not reported	[1151103]
Debian	tuxguitar	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1151103]
Debian	tuxguitar	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1151103]
Opensuse	tuxguitar	rpm	tumbleweed	`2.1.0-1.1`	Not reported	OPENSUSE-SU-2026:11645-1	Not reported

[Debian bug #1151103]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[tuxguitar]Affected
Details (2)
- 1.5.6+dfsg1-6 · all · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · all · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
[tuxguitar-alsa]Affected
Source package: [tuxguitar]
Details (2)
- 1.5.6+dfsg1-6 · amd64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · arm64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
[tuxguitar-fluidsynth]Affected
Source package: [tuxguitar]
Details (2)
- 1.5.6+dfsg1-6 · amd64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · arm64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
[tuxguitar-jack]Affected
Source package: [tuxguitar]
Details (2)
- 1.5.6+dfsg1-6 · amd64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · arm64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
[tuxguitar-jsa]Affected
Source package: [tuxguitar]
Details (2)
- 1.5.6+dfsg1-6 · all · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · all · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
[tuxguitar-oss]Affected
Source package: [tuxguitar]
Details (2)
- 1.5.6+dfsg1-6 · amd64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · arm64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
[tuxguitar-synth-lv2]Affected
Source package: [tuxguitar]
Details (2)
- 1.5.6+dfsg1-6 · amd64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm
- 1.5.6+dfsg1-6 · arm64 · bookworm
  Affected
  nvd · tuxguitar · debian · bookworm

[openSUSE Tumbleweed]

[tuxguitar]Fixed
Source package: [tuxguitar]
Details (1)
- 2.1.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 2.1.0-1.1
  nvd · tuxguitar · opensuse · tumbleweed

Observed: Oct 25, 2026, 2:57:20 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]