TuxGuitar, the open‑source guitar tablature editor, can execute arbitrary code when an attacker crafts a malicious .tg file. The file can set the gervil.soundbank.path to point to an archive containing a bogus META-INF/services/javax.sound.midi.Soundbank entry that references a custom class. When a user opens the file, the application’s unverified class loader loads and instantiates the attacker‑supplied class, running its constructor with the privileges of the running TuxGuitar process. This flaw provides remote code execution with the same rights as the application, potentially allowing an attacker to compromise the host system.

Affected systems are installations of Helge17’s TuxGuitar that run any version earlier than 2.1.0. The issue exists in all prior releases and is addressed in 2.1.0 and later versions. Users must verify that the product version is at least 2.1.0 to avoid this vulnerability.

Risk and exploitability are high: the CVSS score is 8.5, indicating significant severity. No EPSS data is available, but the flaw can be triggered by any user opening a crafted file, making it trivial for an attacker with local or remote file access to exploit. The vulnerability is not listed in CISA’s KEV catalog, yet its nature warrants urgent attention. The likely attack vector is a user‑initiated file open operation, and the presence of a custom class loader without validation is the root cause.