CVE-2026-53752
Received Received - Intake

Stack Overflow in docx4j due to Unbounded Style Inheritance

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-53752
EUVD
EUVD-2026-77696

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
docx4j docx4j 11.5.14
plutext docx4j to 11.5.14 (exc)
plutext docx4j to 11.5.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53752 is a denial of service vulnerability in the docx4j Java library affecting versions before 11.5.14. It occurs when a DOCX file contains styles that inherit from each other in a cycle (e.g., Style A based on Style B, which is based on Style A). The library's PropertyResolver recursively processes these style chains without detecting cycles, causing unbounded recursion and a StackOverflowError.

Detection Guidance

Detecting this vulnerability requires checking if your docx4j library version is below 11.5.14. Use commands like 'mvn dependency:tree' in your project to verify the version. If using a Java application, inspect the library in your classpath or dependency management tool.

Impact Analysis

This vulnerability can crash server-side applications processing untrusted DOCX files. A maliciously crafted file with cyclic styles may terminate the worker thread handling the request, degrade thread pool performance, or deny service. The attack requires no privileges or user interaction beyond submitting the file.

Compliance Impact

This vulnerability primarily causes denial of service by crashing server applications processing untrusted DOCX files, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems storing personal health or user data, potentially leading to compliance issues if service continuity is required by these regulations.

Mitigation Strategies

Upgrade docx4j to version 11.5.14 or later immediately. This version includes cyclic style detection and exception handling to prevent StackOverflowError. If immediate upgrade is not possible, restrict processing of untrusted DOCX files or isolate document processing in disposable workers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53752. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart