Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

brillig

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3crates.ioPublished

    Brillig: Heap corruption in foreign call results with nested tuple arrays

    CVE-2026-41197 · GHSA-jj7c-x25r-r8r3

    Affected
    • crates.io brillig <= 1.0.0-beta.18
    Fixed in
    1.0.0-beta.19· Vendor fix available
    Issue
    Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compileblock(). When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes codegencall() in brilligcall/codegencall.rs, which dispatches to convertssaforeigncall(). Before emitting the foreign call opcode, the compiler must pre-allocate memory for any array results the call will return. This happens through allocateexternalcallresults(), which iterates over the result types. For Type::Array results, it delegates to allocateforeigncallresultarray() to recursively allocate memory on the heap for nested arrays. The BrilligArray struct is the internal representation of a Noir array in Brillig IR. Its size field represents the semi-flattened size, the total number of memory slots the array occupies, accounting for the fact that composite types like tuples consume…

    Recommended action: Upgrade to 1.0.0-beta.19 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →