Brillig: Heap corruption in foreign call results with nested tuple arrays
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-131 and the CVSS impact.
Summary
Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in `BrilligBlock::compile_block()`. When the compiler encounters an `Instruction::Call` with a `Value::ForeignFunction` target, it invokes `codegen_call()` in `brillig_call/code_gen_call.rs`, which dispatches to `convert_ssa_foreign_call()`. Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through `allocate_external_call_results()`, which iterates over the result types. For `Type::Array` results, it delegates to `allocate_foreign_call_result_array()` to recursively allocate memory on the heap for nested arrays. The `BrilligArray` struct is the internal representation of a Noir array in Brillig IR. Its `size` field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by `compute_array_length()` in `brillig_block_variables.rs`. For the outer array, `allocate_external_call_results()` correctly uses `define_variable()`, which internally calls `allocate_value_with_type()`. This function applies the formula above, producing the correct semi-flattened size. However, for nested arrays, `allocate_foreign_call_result_array()` contains a bug. The pattern `Type::Array(_, nested_size)` discards the inner types with `_` and uses only `nested_size`, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap. Version 1.0.0-beta.19 fixes this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| noir-lang | noir | before 1.0.0-beta.19 | 1.0.0-beta.19 | Patch available | CNA |
| — | brillig (crates.io) | before 1.0.0-beta.19 | 1.0.0-beta.19 | Patch available | GHSA-jj7c-x25r-r8r3 |
- noir Vendornoir-lang Affected before 1.0.0-beta.19 Fixed in 1.0.0-beta.19 Patch available CNA
- brillig (crates.io) Vendor— Affected before 1.0.0-beta.19 Fixed in 1.0.0-beta.19 Patch available GHSA-jj7c-x25r-r8r3
Remediation
- Fix · CNA noir (noir-lang) Fixed in 1.0.0-beta.19
- Fix · GHSA-jj7c-x25r-r8r3 brillig (crates.io) Fixed in 1.0.0-beta.19 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41197
- 2026-10-03 Alias added: GHSA-jj7c-x25r-r8r3
References
Sources
- CVE-2026-41197 · CVE Program
- CVE-2026-41197 · NVD
- FIRST EPSS
- GHSA-jj7c-x25r-r8r3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences