brillig

Version	Released
`1.0.0-rc.1` pre	Sep 09, 2026
`1.0.0-rc.0` pre	Sep 07, 2026
`1.0.0-beta.26` pre	Jul 31, 2026
`1.0.0-beta.21` pre	May 07, 2026
`1.0.0-beta.20` pre	Apr 13, 2026
`1.0.0-beta.19` pre	Feb 17, 2026
`1.0.0-beta.18` pre 1 CVE	Jan 06, 2026
`1.0.0-beta.17` pre 1 CVE	Dec 15, 2025
`1.0.0-beta.16` pre 1 CVE	Dec 01, 2025
`1.0.0-beta.15` pre 1 CVE	Nov 05, 2025
`1.0.0-beta.14` pre 1 CVE	Oct 07, 2025
`1.0.0-beta.13` pre 1 CVE	Sep 22, 2025
`1.0.0-beta.12` pre 1 CVE	Sep 04, 2025
`1.0.0-beta.11` pre 1 CVE	Aug 19, 2025
`1.0.0-beta.10` pre 1 CVE	Aug 08, 2025
`1.0.0-beta.9` pre	Jul 24, 2025
`1.0.0-beta.8` pre	Jul 11, 2025
`1.0.0-beta.7` pre	Jun 12, 2025
`1.0.0-beta.6` pre	May 14, 2025
`1.0.0-beta.5` pre	May 09, 2025
`0.46.0` minor 1 CVE	May 21, 2024
`0.45.0` minor 1 CVE	May 06, 2024
`0.44.0` minor 1 CVE	Apr 24, 2024
`0.43.0` minor 1 CVE	Apr 10, 2024
`0.42.0` minor 1 CVE	Mar 25, 2024
`0.41.0` minor 1 CVE	Mar 11, 2024
`0.39.0` minor 1 CVE	Jan 22, 2024
`0.38.0` minor 1 CVE	Dec 18, 2023
`0.37.1` minor 1 CVE	Dec 15, 2023
`0.27.0` minor 1 CVE	Sep 20, 2023
`0.26.1` patch 1 CVE	Sep 12, 2023
`0.26.0` minor 1 CVE	Sep 07, 2023
`0.25.0` minor 1 CVE	Sep 04, 2023
`0.24.1` patch 1 CVE	Sep 03, 2023
`0.24.0` minor 1 CVE	Sep 01, 2023
`0.23.0` minor 1 CVE	Aug 30, 2023
`0.22.0` minor 1 CVE	Aug 18, 2023
`0.21.0` minor 1 CVE	Jul 26, 2023
`0.20.1` patch 1 CVE	Jul 26, 2023
`0.20.0` minor 1 CVE	Jul 21, 2023
`0.19.1` patch 1 CVE	Jul 17, 2023
`0.19.0` minor 1 CVE	Jul 16, 2023
`0.18.2` patch 1 CVE	Jul 12, 2023
`0.18.1` initial 1 CVE	Jul 12, 2023

1.0.0-rc.1 pre

Sep 09, 2026

1.0.0-rc.0 pre

Sep 07, 2026

1.0.0-beta.26 pre

Jul 31, 2026

1.0.0-beta.21 pre

May 07, 2026

1.0.0-beta.20 pre

Apr 13, 2026

1.0.0-beta.19 pre

Feb 17, 2026

1.0.0-beta.18 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jan 06, 2026

1.0.0-beta.17 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Dec 15, 2025

1.0.0-beta.16 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Dec 01, 2025

1.0.0-beta.15 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Nov 05, 2025

1.0.0-beta.14 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Oct 07, 2025

1.0.0-beta.13 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 22, 2025

1.0.0-beta.12 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 04, 2025

1.0.0-beta.11 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Aug 19, 2025

1.0.0-beta.10 pre

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Aug 08, 2025

1.0.0-beta.9 pre

Jul 24, 2025

1.0.0-beta.8 pre

Jul 11, 2025

1.0.0-beta.7 pre

Jun 12, 2025

1.0.0-beta.6 pre

May 14, 2025

1.0.0-beta.5 pre

May 09, 2025

0.46.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

May 21, 2024

0.45.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

May 06, 2024

0.44.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Apr 24, 2024

0.43.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Apr 10, 2024

0.42.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Mar 25, 2024

0.41.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Mar 11, 2024

0.39.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jan 22, 2024

0.38.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Dec 18, 2023

0.37.1 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Dec 15, 2023

0.27.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 20, 2023

0.26.1 patch

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 12, 2023

0.26.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 07, 2023

0.25.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 04, 2023

0.24.1 patch

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 03, 2023

0.24.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Sep 01, 2023

0.23.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Aug 30, 2023

0.22.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Aug 18, 2023

0.21.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 26, 2023

0.20.1 patch

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 26, 2023

0.20.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 21, 2023

0.19.1 patch

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 17, 2023

0.19.0 minor

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 16, 2023

0.18.2 patch

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 12, 2023

0.18.1 initial

1 CVE

CVE-2026-41197 GHSA-jj7c-x25r-r8r3 Apr 21, 2026

Brillig: Heap corruption in foreign call results with nested tuple arrays

Critical

Network Low None None

Description

Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile_block(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call().

Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocate_external_call_results(), which iterates over the result types. For Type::Array results, it delegates to allocate_foreign_call_result_array() to recursively allocate memory on the heap for nested arrays.

The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume multiple slots per element. This size is computed by compute_array_length() in brillig_block_variables.rs:

pub(crate) fn compute_array_length(item_typ: &CompositeType, elem_count: usize) -> usize {
    item_typ.len() * elem_count
}

For the outer array, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type(). This function applies the formula above, producing the correct semi-flattened size.

However, for nested arrays, allocate_foreign_call_result_array() contains a bug. When it encounters a nested Type::Array(types, nested_size), it calls:

Type::Array(_, nested_size) => { 
	let inner_array = self.brillig_context.allocate_brillig_array(*nested_size as usize);
	// ....
}

The pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size, the semantic length of the nested array (the number of logical elements), not the semi-flattened size. For simple element types this works correctly, but for composite element types it under-allocates. Consider a nested array of type [(u32, u32); 3]:

Semantic length: 3 (three tuples)
Element size: 2 (each tuple has two fields)
Required semi-flattened size: 6 memory slots

The current code passes 3 to allocate_brillig_array(), which then calls codegen_initialize_array(). This function allocates array.size + ARRAY_META_COUNT slots, only 4 slots instead of the required 7 (6 data + 1 metadata). When the VM executes the foreign call and writes 6 values plus metadata, it overwrites adjacent heap memory.

Impact

Foreign calls returning nested arrays of tuples or other composite types corrupt the Brillig VM heap.

Recommendation

Multiply the semantic length by the number of element types when allocating nested arrays. Extract the inner types from the pattern and replace the nested_size argument to allocate_brillig_array() with types.len() * nested_size to compute the semi-flattened size. Alternatively, reuse the existing compute_array_length() helper function to maintain consistency with outer array allocation.

Fixed in


          1.0.0-beta.19

References

Updated May 05, 2026 · Source: OSV.dev

Jul 12, 2023

Activity

Reach

Details