CVE-2026-41197: Noir Brillig Buffer Overflow Vulnerability

CVE-2026-41197 Overview

CVE-2026-41197 is a critical memory corruption vulnerability in the Noir programming language's Brillig bytecode compiler. Noir is a Domain Specific Language (DSL) designed for SNARK proving systems that utilizes ACIR (Abstract Circuit Intermediate Representation) compatible proving systems, with Brillig serving as the bytecode ACIR uses for non-determinism.

The vulnerability exists in how the compiler handles memory allocation for nested arrays containing composite types (such as tuples) when processing foreign function calls. When allocating memory for nested array results, the compiler incorrectly uses the semantic length (number of logical elements) instead of the semi-flattened size (total memory slots needed), leading to heap buffer under-allocation and subsequent memory corruption.

Critical Impact

This vulnerability allows network-based attackers to corrupt the Brillig VM heap without any user interaction or special privileges. Successful exploitation can compromise the confidentiality, integrity, and availability of systems running affected Noir programs that utilize foreign calls returning nested arrays of composite types.

Affected Products

• Noir versions prior to 1.0.0-beta.19
• Applications compiled with vulnerable Noir compiler versions
• Systems executing Brillig bytecode generated by affected compilers

Discovery Timeline

• April 23, 2026 - CVE CVE-2026-41197 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41197

Vulnerability Analysis

The vulnerability is classified under CWE-131 (Incorrect Calculation of Buffer Size), which occurs when software does not correctly calculate the size needed for a buffer, potentially leading to buffer overflows or under-allocations.

When Noir programs invoke external functions through foreign calls and the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it processes the call through codegen_call() in brillig_call/code_gen_call.rs, which dispatches to convert_ssa_foreign_call(). Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results through allocate_external_call_results().

The BrilligArray struct represents Noir arrays in Brillig IR, with its size field indicating the semi-flattened size—the total memory slots the array occupies. This size accounts for composite types like tuples that consume multiple slots per element and is computed by compute_array_length() in brillig_block_variables.rs.

For outer arrays, allocate_external_call_results() correctly uses define_variable(), which internally calls allocate_value_with_type() to produce the correct semi-flattened size. However, for nested arrays, allocate_foreign_call_result_array() contains a critical bug: the pattern Type::Array(_, nested_size) discards the inner types with _ and uses only nested_size—the semantic length rather than the semi-flattened size.

Root Cause

The root cause lies in the allocate_foreign_call_result_array() function's handling of nested array type information. When processing Type::Array(_, nested_size), the function discards the inner type information (represented by the wildcard _) and relies solely on nested_size for memory allocation. While this works correctly for simple element types where each element occupies exactly one memory slot, it fails catastrophically for composite element types like tuples that require multiple slots per element.

This pattern matching oversight means that when a nested array contains tuples of N elements, the compiler allocates only enough memory for N single-slot values instead of the N × (tuple_size) slots actually required.

Attack Vector

The vulnerability can be exploited through network-based attacks without requiring authentication or user interaction. An attacker can craft malicious inputs to Noir programs that process foreign function calls returning nested arrays of composite types.

The exploitation mechanism works as follows:

1. A Noir program defines a foreign function that returns nested arrays containing tuples or other composite types
2. When compiled to Brillig bytecode, the compiler under-allocates heap memory for the nested array results
3. When the foreign call executes and writes its return values, it overflows the allocated buffer
4. The heap corruption can lead to arbitrary memory access, data corruption, or control flow hijacking within the Brillig VM

Detection Methods for CVE-2026-41197

Indicators of Compromise

• Unexpected crashes or undefined behavior in Noir programs utilizing foreign calls with nested array returns
• Memory corruption errors or heap-related exceptions in Brillig VM execution
• Anomalous behavior in SNARK proof generation or verification processes
• Integrity failures in cryptographic operations relying on affected Noir programs

Detection Strategies

• Audit Noir source code for foreign function declarations that return nested arrays containing tuples or composite types
• Review compiled Brillig bytecode for memory allocation patterns around foreign call sites
• Implement runtime bounds checking in Brillig VM environments to detect heap overflows
• Monitor for unexpected memory access patterns during foreign call execution

Monitoring Recommendations

• Enable verbose logging for Brillig VM heap operations to identify allocation anomalies
• Implement integrity checks on heap metadata structures before and after foreign call execution
• Deploy memory sanitizers (when available) in development and testing environments
• Monitor system resource usage for signs of memory corruption or leakage during Noir program execution

How to Mitigate CVE-2026-41197

Immediate Actions Required

• Upgrade Noir to version 1.0.0-beta.19 or later immediately
• Recompile all Noir programs that use foreign functions returning nested arrays with the patched compiler
• Audit existing deployments to identify programs that may be affected by this vulnerability
• Temporarily disable or isolate Noir programs using affected foreign call patterns until patched bytecode can be deployed

Patch Information

The vulnerability has been fixed in Noir version 1.0.0-beta.19. The patch corrects the memory allocation logic in allocate_foreign_call_result_array() to properly compute the semi-flattened size for nested arrays containing composite types, ensuring sufficient memory is allocated on the Brillig VM heap.

For detailed patch information, see the GitHub Noir Release v1.0.0-beta.19 and the GitHub Security Advisory GHSA-jj7c-x25r-r8r3.

Workarounds

• Avoid using foreign functions that return nested arrays containing tuples or composite types until the compiler is upgraded
• Refactor affected code to use flat array structures or single-level nesting with simple types as an interim solution
• Implement additional validation layers around foreign call results in application code
• Consider using ACIR-only compilation paths if Brillig-specific features are not required

# Upgrade Noir to patched version
nargo --version  # Check current version
# Update to v1.0.0-beta.19 or later following official installation instructions
# Recompile affected projects
nargo compile --force