CVE-2026-72711 Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::addopaque omits the checknometavarnofvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

CVE-2026-72844

CVE-2026-72844 is a kernel soundness break in Lean 4 , the theorem prover. The root cause is a missing type check in environment::add_inductive (src/kernel/inductive.cpp): nested inductive applications replaced by auxiliary types had their parametric arguments unchecked, and the kernel did not ve...