Memory Management Flaw in Noir Language Affecting Brillig Bytecode by Noir

CVE-2026-41197

What is CVE-2026-41197?

The Noir programming language has a vulnerability related to its handling of memory allocation for foreign function calls returning nested arrays. While the compiler processes the instructions correctly for simple types, it encounters issues with composite types like tuples. During memory allocation, the inner types of nested arrays are improperly accounted for, leading to under-allocation and potential corruption of the Brillig VM heap. This flaw affects users compiling to Brillig bytecode and can result in program failures when executing foreign function calls that return complex, nested data structures. Users should upgrade to version 1.0.0-beta.19 to mitigate this risk.

References