CVE-2025-67125: 
NixOS vulnerability analysis and mitigation

CVE-2025-67125 is a signed integer overflow vulnerability in docopt.cpp v0.6.2, specifically in the LeafPattern::match function within docopt_private.h. When merging occurrence counters for repeating options (e.g., -v/--verbose), if the existing counter is seeded with LONG_MAX (e.g., from an attacker-influenced environment variable or config file), adding a single user-supplied occurrence triggers a signed integer overflow (LONG_MAX + 1), resulting in counter wrap with negative or unbounded semantics. This can lead to logic/policy bypass in applications relying on occurrence-based limits, rate-gating, or safety toggles; in hardened builds (UBSan or -ftrapv), it may also cause process abort (DoS). The vulnerability was published on January 23, 2026, and carries a CVSS v3.1 base score of 4.4 (Medium) (Feedly, GitHub Advisory).

The root cause is an unchecked signed long addition in docopt::LeafPattern::match() (file: docopt_private.h, line 454), classified as CWE-190 (Integer Overflow or Wraparound). When an application seeds a counting option's default value from an untrusted source (environment variable, config file, plugin-provided usage string, or bot/automation layer) with LONG_MAX (9223372036854775807), the first legitimate user occurrence of that option forces the computation LONG_MAX + 1, which is undefined behavior in C++ for signed integers. The wrapped/negative result may be interpreted by downstream application logic as "unlimited" or may bypass max-only guards (e.g., if (count <= N)). The attack vector is local with user interaction required in typical CLI deployments, but escalates to network-level if defaults are hydrated from remote/bot sources (GitHub Advisory, docopt.cpp repo).

Successful exploitation can cause two distinct impacts: (1) logic/policy bypass, where a wrapped or negative counter value disables occurrence-based limits, rate gates, verbosity caps, or debug/safety toggles in applications built on docopt.cpp; and (2) denial of service (process abort) in builds compiled with UBSan or -ftrapv, where the signed overflow is treated as a fatal runtime error. Confidentiality impact is none; integrity and availability are both rated low under the conservative local-CLI scenario. The severity increases if the affected application uses occurrence counts to gate privileged operations or safety-critical features (GitHub Advisory, Feedly).

A proof-of-concept (PoC) is publicly available, published by researcher Ali Firas (thesmartshadow) as a GitHub Gist, including both a white-box UBSan probe (poc_whitebox_ubsan.cpp) and a realistic host scenario (vuln_realistic.cpp) demonstrating the overflow via an attacker-controlled VERBOSE_DEFAULT environment variable (GitHub Advisory). The EPSS score is 0.000050 (very low probability of exploitation in the wild), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the available data (Feedly). No threat actor attribution has been reported. Exploitation requires the target application to source a counting option's default from attacker-influenced input, which is a prerequisite that limits the practical attack surface.

1. Identify a target application: Find a CLI application built with docopt.cpp v0.6.2 that uses a repeating/counting option (e.g., -v/--verbose) and sources its default value from an attacker-controllable input such as an environment variable, config file, plugin-provided usage string, or a bot/automation layer.
2. Seed the default with LONG_MAX: Set the environment variable or config value that controls the option's default to 9223372036854775807 (LONG_MAX). For example: export VERBOSE_DEFAULT=9223372036854775807.
3. Invoke the target CLI with one occurrence of the flag: Run the application with a single instance of the counting option, e.g., ./target_app -v. This causes docopt.cpp to merge the seeded default (LONG_MAX) with the new occurrence count (1) via an unchecked signed addition in LeafPattern::match() at docopt_private.h:454.
4. Trigger the overflow: The addition LONG_MAX + 1 overflows, producing a wrapped (negative or zero) counter value. In hardened builds (UBSan/-ftrapv), this aborts the process (DoS). In standard builds, the wrapped value is returned to the application.
5. Achieve policy bypass: The application's downstream logic receives the wrapped counter and may interpret it as "unlimited" or as passing a max-only guard (e.g., if (count <= N) where count is now negative), bypassing rate limits, verbosity caps, debug mode toggles, or other occurrence-based safety controls (GitHub Advisory).

• Environment / Process: Presence of environment variables set to 9223372036854775807 (LONG_MAX) for options that control CLI counting flags (e.g., VERBOSE_DEFAULT, or similar app-specific variables) before process invocation.
• Logs: Application crash logs or core dumps referencing docopt_private.h:454 with UBSan messages such as runtime error: signed integer overflow: 1 + 9223372036854775807 cannot be represented in type 'long int'; unexpected process aborts in CLI tools using docopt.cpp.
• Behavioral: Unexpected enablement of debug, verbose, or unsafe modes in CLI applications; bypass of rate-limiting or occurrence-based access controls without corresponding legitimate user input.
• File System: Presence of PoC files (poc_whitebox_ubsan.cpp, vuln_realistic.cpp, run_all.sh) or compiled binaries (poc_whitebox_ubsan, vuln_realistic_ubsan) on the system (GitHub Advisory).

No official patch has been released by the docopt.cpp upstream project as of the available data. The researcher recommends replacing the unchecked signed addition in LeafPattern::match() with checked/saturated arithmetic that normalizes negative values and clamps at LONG_MAX before incrementing (see the mitigation sketch in the advisory). As a workaround, applications should validate and sanitize any externally sourced default values for counting options before passing them to docopt, ensuring they cannot be set to LONG_MAX or other boundary values. Compiling with UBSan (-fsanitize=undefined,signed-integer-overflow) can help detect the overflow during testing, though it will cause process abort in production if triggered (GitHub Advisory, docopt.cpp repo).

The vulnerability was discovered and disclosed by researcher Ali Firas (thesmartshadow) via a GitHub Gist advisory, with coordinated disclosure described as pending at the time of publication. No official response from the docopt.cpp maintainers has been publicly documented. Community tracking has been noted on platforms including Vulners, VulDB, CVEFeed, and Tenable (Nessus plugin 296423), indicating routine security community awareness but no significant public debate or media coverage (Feedly).