TuxGuitar EUVD-2026-102925

Exploitation requires the victim to open an attacker-supplied .tg file in TuxGuitar prior to version 2.1.0; the file must set the gervil.soundbank.path property to reference an archive containing a META-INF/services/javax.sound.midi.Soundbank entry that names an attacker-controlled class bundled in that same archive. The limiting factors are: (1) mandatory user interaction - the user must actively open the malicious file (UI:P); (2) local delivery - there is no remote network service to attack, the payload travels as a document; and (3) the attacker-supplied class executes only with the privileges of the TuxGuitar process/user, not elevated. No special non-default configuration is needed because the vulnerable JARSoundbankReader and its service registration ship by default in affected versions.

This is a genuine code-execution vulnerability but its real-world priority is moderated by the delivery model. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) correctly captures the core dynamic: no authentication is required (PR:N) and complexity is low (AC:L), but exploitation is Local (AV:L) and requires passive user interaction (UI:P) - the victim must obtain and open a malicious .tg file in TuxGuitar. Impact is maximal (VC:H/VI:H/VA:H, CWE-94 arbitrary code execution in the process context), with no scope change to other systems (SC/SI/SA:N). No EPSS score, CISA KEV listing, or SSVC decision data was provided, and there is no evidence of a public proof-of-concept in the references (only the advisory, fix commit, and release) - so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a high-impact but user-interaction-gated, local-file-triggered flaw. The practical risk is therefore social-engineering-dependent (tricking a musician/user into opening a crafted tablature file) rather than mass-exploitable, and the niche user base limits widespread targeting. Treat as a priority for TuxGuitar users who handle shared .tg files, but not a drop-everything internet-facing emergency.

An attacker crafts a malicious .tg tablature file that sets gervil.soundbank.path to point at an embedded archive (which can be the .tg file itself) containing a META-INF/services/javax.sound.midi.Soundbank entry naming an attacker-supplied class. The file is shared via a music forum, email, or download, and when the victim opens it in a vulnerable TuxGuitar (pre-2.1.0), JARSoundbankReader loads and instantiates the class, running its constructor with the user's privileges. No public exploit code was identified in the provided references, but the technique is fully described in the advisory and requires only that the victim open the file.