Heap corruption in Noir Brillig compiler for nested tuple array foreign calls (CVE-2026-41197)

A bug in the Noir compiler's Brillig bytecode backend causes under-allocation of heap memory when pre-allocating results for foreign calls that return nested arrays of composite types such as tuples. The compiler discards inner type information and uses only the semantic element count instead of the semi-flattened size, resulting in writes that overwrite adjacent heap memory when the Brillig VM executes the foreign call. Affected versions: - <=1.0.0-beta.18 We recommend updating to: 1.0.0-beta.19. CVSS 9.3 · our assessment: act_now Reference: https://github.com/noir-lang/noir/security/advisories/GHSA-jj7c-x25r-r8r3 Details: https://vuln.today/cve/CVE-2026-41197