CVE-2026-41197
Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in `BrilligBlock::compile_block()`. When the compiler encounters an `Instruction::Call` with a `Value::ForeignFunction` target, it invokes `codegen_call()` in `brillig_call/code_gen_call.rs`, which dispatches to `convert_ssa_foreign_call()`. Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through `allocate_external_call_results()`, which iterates over the result types. For `Type::Array` results, it delegates to `allocate_foreign_call_result_array()` to recursively allocate memory on the heap for nested arrays. The `BrilligArray` struct is the internal representation of a Noir array in Brillig IR. Its `size` field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by `compute_array_length()` in `brillig_block_variables.rs`. For the outer array, `allocate_external_call_results()` correctly uses `define_variable()`, which internally calls `allocate_value_with_type()`. This function applies the formula above, producing the correct semi-flattened size. However, for nested arrays, `allocate_foreign_call_result_array()` contains a bug. The pattern `Type::Array(_, nested_size)` discards the inner types with `_` and uses only `nested_size`, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap. Version 1.0.0-beta.19 fixes this issue.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.40%
- CWE
- CWE-131
- Published
- 2026-04-23
- Last modified
- 2026-04-25
Affected products
- noir-lang noir
Weakness type
Related vulnerabilities
- CVE-2026-22590 — Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessage
- CVE-2026-69598 — Windows iSCSI Remote Code Execution Vulnerability
- CVE-2026-78221 — An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1...
- CVE-2026-18743 — Popt-devel: popt-static: short realloc in poptconfigfiletostring
- CVE-2026-78002 — Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
- CVE-2026-44254 — Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
- CVE-2026-52834 — jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
- CVE-2026-75093 — sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size