Hi,

The following vulnerability was published for tuxguitar.

CVE-2026-55543[0]:
| TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0,
| an untrusted .tg file can set gervil.soundbank.path to reference an
| on-disk archive, including the .tg file itself, whose META-
| INF/services/javax.sound.midi.Soundbank entry names an attacker-
| supplied class stored in that archive. When a user opens the file,
| JARSoundbankReader uses an unverified class loader to load and
| instantiate that class, executing its constructor with the
| privileges of the TuxGuitar process. This issue is fixed in version
| 2.1.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-55543
https://www.cve.org/CVERecord?id=CVE-2026-55543
[1] https://github.com/helge17/tuxguitar/security/advisories/GHSA-v66p-c82h-w3cq
[2] https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore