crates.io/brillig CVE-2026-41197: critical 9.3, EPSS 0.40%

Brillig: Heap corruption in foreign call results with nested tuple arrays

Action: Upgrade brillig to 1.0.0-beta.19 or later.

cargo update -p brillig --precise 1.0.0-beta.19

Affected

Fixed versions

Sources

• osv: GHSA-jj7c-x25r-r8r3
• nvd: CVE-2026-41197
• https://github.com/noir-lang/noir/security/advisories/GHSA-jj7c-x25r-r8r3
• https://github.com/noir-lang/noir
• https://github.com/noir-lang/noir/releases/tag/v1.0.0-beta.19

CVE-2026-41197 · published 2026-04-21T20:16:09Z · modified 2026-05-05T16:10:00.908903Z · JSON