CVE-2026-72703 rocq-prover CVE debrief

Who should care

Users of Rocq Prover, especially those in roles related to formal verification, proof development, and software development using Coq and Rocq Prover, should assess their exposure and verify their versions.

Why it matters

CVE-2026-72703 is a vulnerability in Rocq Prover's guard checker that could lead to non-terminating definitions being admitted as structurally decreasing, potentially resulting in a proof of False. Users of Rocq Prover should verify their versions and apply patches if necessary.

• Verify and patch vulnerable Rocq Prover versions to prevent potential exploitation.
• Review and update Coq and Rocq Prover installations to ensure version 9.2.0 or later is used.
• Monitor for and respond to potential exploitation attempts.

Technical summary

The guard checker in Rocq Prover incorrectly treats parameters in nested mutual fixpoints as uniform without examining cross-calls between different bodies of the fixpoint. This could lead to non-terminating definitions being admitted as structurally decreasing, potentially resulting in a proof of False. The issue was introduced in Coq 8.20 and fixed in Rocq 9.2.0. The vulnerability could allow non-terminating definitions to be admitted as structurally decreasing, potentially resulting in a proof of False. Users of Rocq Prover should verify their versions and apply patches if necessary.

Defensive priority

Verify and apply patches for Rocq Prover versions before 9.2.0.

Recommended defensive actions

• Verify the version of Rocq Prover in use and apply patches if necessary.
• Review and update Coq and Rocq Prover installations to ensure version 9.2.0 or later is used.
• Monitor for and respond to potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Rocq Prover's guard checker. The issue was introduced in Coq 8.20 and fixed in Rocq 9.2.0. The vulnerability could allow non-terminating definitions to be admitted as structurally decreasing, potentially resulting in a proof of False. Users should verify their versions and apply patches if necessary. The proof requires no axioms, plugins or unsafe flags and Print Assumptions reports it as closed under the global context. Evidence is limited to public CVE details and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.