Quick answers
- Is CVE-2026-72705 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72705 being exploited in the wild.
- How severe is CVE-2026-72705?
- Medium severity, with a CVSS score of 6.3, published 24 August 2026.
- Which products and versions are affected?
- Rocq Prover ≤ 9.1.0.
- Is there a fix for CVE-2026-72705?
- A patch was published on 2026: Fixed in Rocq 9.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-72705 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-72705?
- Check whether you run Rocq Prover at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a logic error in the guard checker, a component that enforces structural recursion constraints on fixpoint definitions. The checker fails to track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint, which then applies it to arguments that are not subterms of the original structural argument. This permits construction of a Russell's paradox variant, creating a type definitionally equal to its own negation (russell 1 ≡ russell 1 → False), which can be self-applied to derive False in purely definitional code. The exploit requires no axioms, tactics, unsafe features, or plugins, and is detectable only by analyzing the proof structure. Fixed in Rocq 9.2.0 (PR #21684).
Affected products
- Rocq Rocq Prover ≤ 9.1.0
Timeline
- 2026-08-24: disclosed
- 2026: patched: Fixed in Rocq 9.2.0