{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aleanproverlean4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:leanprover:lean:4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-72844"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Lean 4"],"_cs_severities":["high"],"_cs_tags":["vulnerability","formal-verification","logic-soundness"],"_cs_type":"advisory","_cs_vendors":["Lean"],"content_html":"\u003cp\u003eA soundness vulnerability in the Lean 4 kernel (CVE-2026-72844) enables the construction of checked proofs of 'False' (e.g., 0 = 1). The flaw stems from two primary issues: the kernel fails to verify that the structure named in a projection expression matches the type of the value being projected, and the \u003ccode\u003eenvironment::add_inductive\u003c/code\u003e function in \u003ccode\u003esrc/kernel/inductive.cpp\u003c/code\u003e fails to perform necessary type-checking for nested definitions. This compromise undermines the foundational logical guarantees of the theorem prover. No further update has been provided regarding fixed versions or mitigation timelines beyond the initial disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability allows for the creation of arbitrary proofs of logically false propositions within the Lean 4 environment. It does not require the use of explicit axioms, the \u003ccode\u003esorry\u003c/code\u003e keyword, \u003ccode\u003eunsafeCast\u003c/code\u003e operations, or the modification of \u003ccode\u003e.olean\u003c/code\u003e files, allowing the exploit to bypass standard verification checks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory environments utilizing Lean 4 for formal verification or critical logical proofs.\u003c/li\u003e\n\u003cli\u003eMonitor the official Lean 4 repository and the \u003ccode\u003eoss-security\u003c/code\u003e mailing list for the release of security patches or official mitigation guidance.\u003c/li\u003e\n\u003cli\u003eReview critical proof developments that depend on the integrity of the Lean 4 kernel; consider re-verifying proofs using patched versions once updates are available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T02:22:56Z","date_published":"2026-10-26T02:22:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lean4-soundness/","summary":"A soundness vulnerability in the Lean 4 kernel allows the construction of false mathematical proofs due to improper validation of structure projections and insufficient type-checking in the inductive definition process.","title":"Lean 4: Kernel soundness vulnerability via nested inductive projections (CVE-2026-72844)","url":"https://feed.craftedsignal.io/briefs/2026-10-lean4-soundness/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:leanprover:lean:4:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}