CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated)

CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day

Summary by Cyber Security News26 Oct 2026, 01:18 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/382

Posted by Jonathan Brossard on Oct 25 1. Summary A soundness bug in the Rocq (formerly Coq) kernel's guard checker allows construction of a checked proof of False — and by extension, any proposition, including 0 = 1. The guard checker does not recheck the recursive tree (rectree) for an inductive type parameter after a transport (rewrite via eq_rect/rew) changes that parameter.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-90634: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files

CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability

CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated) — 0-day

3 lessons from frontier AI vulnerability research

Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603