Read the docs
TI-2026-29819 Aliases CVE-2026-41197GHSA-jj7c-x25r-r8r3

Brillig: Heap corruption in foreign call results with nested tuple arrays

Priority MEDIUM 48CWE-131Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-131 and the CVSS impact.

Summary

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in `BrilligBlock::compile_block()`. When the compiler encounters an `Instruction::Call` with a `Value::ForeignFunction` target, it invokes `codegen_call()` in `brillig_call/code_gen_call.rs`, which dispatches to `convert_ssa_foreign_call()`. Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through `allocate_external_call_results()`, which iterates over the result types. For `Type::Array` results, it delegates to `allocate_foreign_call_result_array()` to recursively allocate memory on the heap for nested arrays. The `BrilligArray` struct is the internal representation of a Noir array in Brillig IR. Its `size` field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by `compute_array_length()` in `brillig_block_variables.rs`. For the outer array, `allocate_external_call_results()` correctly uses `define_variable()`, which internally calls `allocate_value_with_type()`. This function applies the formula above, producing the correct semi-flattened size. However, for nested arrays, `allocate_foreign_call_result_array()` contains a bug. The pattern `Type::Array(_, nested_size)` discards the inner types with `_` and uses only `nested_size`, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap. Version 1.0.0-beta.19 fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed noir (noir-lang): 1.0.0-beta.19brillig (crates.io): 1.0.0-beta.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
noir-langnoirbefore 1.0.0-beta.191.0.0-beta.19Patch availableCNA
—brillig (crates.io)before 1.0.0-beta.191.0.0-beta.19Patch availableGHSA-jj7c-x25r-r8r3
  • noir Vendornoir-lang Affected before 1.0.0-beta.19 Fixed in 1.0.0-beta.19 Patch available CNA
  • brillig (crates.io) Vendor— Affected before 1.0.0-beta.19 Fixed in 1.0.0-beta.19 Patch available GHSA-jj7c-x25r-r8r3

Remediation

  • Fix · CNA noir (noir-lang) Fixed in 1.0.0-beta.19
  • Fix · GHSA-jj7c-x25r-r8r3 brillig (crates.io) Fixed in 1.0.0-beta.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41197
  2. 2026-10-03 Alias added: GHSA-jj7c-x25r-r8r3

References

Sources