The vulnerability arises because the guard checker in Rocq Prover does not revalidate the recursive tree of an inductive type after a transport rewrite. This allows an attacker to craft proofs that introduce a rewritten recursive argument that bypasses structural termination checks. When a second fixpoint inherits this altered tree without verification, the system accepts a definition that is not structurally decreasing. This proves that a natural number equals its own successor, leading to False, and from that any proposition can be derived, effectively breaking the soundness of the entire proof environment. The weakness corresponds to CWE-670, improper verification of internal consistency.

Affected systems include the Rocq proof assistant, version 9.2.0 and earlier, as identified by the rocq-prover:rocq vendor. The CVE description indicates that the flaw exists in the guard checker for all releases up to at least 9.2.0. The GitHub issue and pull request references confirm the vulnerability remains in the current mainline until a patch is merged.

The CVSS score of 6.8 places the vulnerability in the medium severity range. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Attackers would need to construct and submit a malicious proof that triggers the transport rewrite in a context where univalence axioms are available. Based on the description, the likely attack vector is via local or remote access to the proof development environment, requiring the developer to supply the vulnerable definition. Because no public exploit has been reported, the risk remains theoretical but significant for systems that rely on Rocq's soundness for critical verifications.