Vulnerability-Lookup

CVE-2026-53752 (GCVE-0-2026-53752)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:31 – Updated: 2026-09-16 15:54

Title

docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

Summary

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 15:54 UTC

CWE

CWE-674 - Uncontrolled Recursion
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/plutext/docx4j/security/adviso…	x_refsource_CONFIRM
https://github.com/plutext/docx4j/commit/47b528c7…	x_refsource_MISC
https://github.com/plutext/docx4j/commit/e06cafb3…	x_refsource_MISC
https://github.com/plutext/docx4j/releases/tag/do…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
plutext	docx4j	Affected: < 11.5.14	guessed
org.docx4j	docx4j-core	Affected: < 11.5.14	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:54:10.466468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:54:21.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docx4j",
          "vendor": "plutext",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.5.14"
            }
          ]
        },
        {
          "product": "docx4j-core",
          "vendor": "org.docx4j",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.5.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:31:07.287Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43"
        },
        {
          "name": "https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f"
        },
        {
          "name": "https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06"
        },
        {
          "name": "https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14"
        }
      ],
      "source": {
        "advisory": "GHSA-gc95-3vw8-vg43",
        "discovery": "UNKNOWN"
      },
      "title": "docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53752",
    "datePublished": "2026-09-14T17:31:07.287Z",
    "dateReserved": "2026-06-10T17:48:40.546Z",
    "dateUpdated": "2026-09-16T15:54:21.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53752",
      "date": "2026-09-17",
      "epss": "0.00441",
      "percentile": "0.37546"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53752\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-14T18:17:51.773\",\"lastModified\":\"2026-09-16T16:17:08.503\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"plutext\",\"product\":\"docx4j\",\"versions\":[{\"version\":\"\u003c 11.5.14\",\"status\":\"affected\"}]},{\"vendor\":\"org.docx4j\",\"product\":\"docx4j-core\",\"versions\":[{\"version\":\"\u003c 11.5.14\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-16T15:54:10.466468Z\",\"id\":\"CVE-2026-53752\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"},{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-674\", \"lang\": \"en\", \"description\": \"CWE-674: Uncontrolled Recursion\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-770\", \"lang\": \"en\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43\"}, {\"name\": \"https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f\"}, {\"name\": \"https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06\"}, {\"name\": \"https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14\"}], \"affected\": [{\"vendor\": \"plutext\", \"product\": \"docx4j\", \"versions\": [{\"version\": \"\u003c 11.5.14\", \"status\": \"affected\"}]}, {\"vendor\": \"org.docx4j\", \"product\": \"docx4j-core\", \"versions\": [{\"version\": \"\u003c 11.5.14\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-14T17:31:07.287Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.\"}], \"source\": {\"advisory\": \"GHSA-gc95-3vw8-vg43\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-53752\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T15:54:10.466468Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T15:54:16.246Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-53752\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-06-10T17:48:40.546Z\", \"datePublished\": \"2026-09-14T17:31:07.287Z\", \"dateUpdated\": \"2026-09-16T15:54:21.969Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53752

Vulnerability from fkie_nvd - Published: 2026-09-14 18:17 - Updated: 2026-09-16 16:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f
	security-advisories@github.com	https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06
	security-advisories@github.com	https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14
	security-advisories@github.com	https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "docx4j",
          "vendor": "plutext",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.5.14"
            }
          ]
        },
        {
          "product": "docx4j-core",
          "vendor": "org.docx4j",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.5.14"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14."
    }
  ],
  "id": "CVE-2026-53752",
  "lastModified": "2026-09-16T16:17:08.503",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53752",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T15:54:10.466468Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T18:17:51.773",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GC95-3VW8-VG43

Vulnerability from github – Published: 2026-08-17 21:55 – Updated: 2026-08-17 21:55

Summary

docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

Details

Summary

docx4j's PropertyResolver and several adjacent helpers recursively walk the OpenXML style inheritance chain (w:basedOn) without cycle detection.

A WordprocessingML document containing a cyclic style chain (for example, Style A based on B and Style B based on A) causes unbounded recursion and a java.lang.StackOverflowError within the property-resolution code path.

These helpers are used by operations that require effective style resolution, including common conversion and TOC-related paths. As a result, most server-side pipelines that accept a user-supplied docx and process it through docx4j can likely be crashed by a file containing a cyclic style reference.

Details

Representative snippet: PropertyResolver.fillPPrStack

private void fillPPrStack(String styleId, Stack<PPr> pPrStack) {
    Style style = liveStyles.get(styleId);
    ...
    // if it is based on, recurse
    if (style.getBasedOn() == null) {
        log.debug("Style " + styleId + " is a root style.");
    } else if (style.getBasedOn().getVal() != null) {
        String basedOnStyleName = style.getBasedOn().getVal();
        fillPPrStack(basedOnStyleName, pPrStack);   // ← unbounded recursion
        ...

Impact

This is a denial of service against a server-side application that processes untrusted docx files via docx4j.

An upload causes the processing thread to be terminated with StackOverflowError which may crash the worker thread, degrade the thread pool, or evade normal per-request CPU and heap-memory safeguards in containers and serverless functions (because the failure mode is thread-stack exhaustion rather than gradual resource consumption).

The attack depends on the host application's access controls and requires no user interaction beyond submitting the file. Detection is difficult because the file is a well-formed OOXML package containing ordinary style elements, and passes standard antivirus and content-inspection rules.

Severity: High for server-side applications that process untrusted DOCX files using docx4j style/property resolution (unless the application catches StackOverflowError, isolates conversion in disposable worker processes, restarts workers cleanly, and the practical impact is only failure of one request). Severity may be Medium where document upload requires authentication, processing is isolated, or the failure is limited to a single request/worker.

Credits

Thanks to Koh You Liang (@Isopach) for responsibly disclosing this issue.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.5.13"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.docx4j:docx4j-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.5.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53752"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T21:55:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\ndocx4j\u0027s `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chain (`w:basedOn`) without cycle detection. \n\nA WordprocessingML document containing a cyclic style chain (for example, Style A based on B and Style B based on A) causes unbounded recursion and a `java.lang.StackOverflowError` within the property-resolution code path.\n\nThese helpers are used by operations that require effective style resolution, including common conversion and TOC-related paths.  As a result, most server-side pipelines that accept a user-supplied docx and process it through docx4j can likely be crashed by a file containing a cyclic style reference.\n\n### Details\n\nRepresentative snippet: `PropertyResolver.fillPPrStack`\n\n```java\nprivate void fillPPrStack(String styleId, Stack\u003cPPr\u003e pPrStack) {\n    Style style = liveStyles.get(styleId);\n    ...\n    // if it is based on, recurse\n    if (style.getBasedOn() == null) {\n        log.debug(\"Style \" + styleId + \" is a root style.\");\n    } else if (style.getBasedOn().getVal() != null) {\n        String basedOnStyleName = style.getBasedOn().getVal();\n        fillPPrStack(basedOnStyleName, pPrStack);   // \u2190 unbounded recursion\n        ...\n```\n\n### Impact\nThis is a denial of service against a server-side application that processes untrusted docx files via docx4j. \n\nAn upload causes the processing thread to be terminated with `StackOverflowError` which may crash the worker thread, degrade the thread pool, or evade normal per-request CPU and heap-memory safeguards in containers and serverless functions (because the failure mode is thread-stack exhaustion rather than gradual resource consumption).\n\nThe attack depends on the host application\u0027s access controls and requires no user interaction beyond submitting the file. Detection is difficult because the file is a well-formed OOXML package containing ordinary style elements,  and passes standard antivirus and content-inspection rules.\n\nSeverity: High for server-side applications that process untrusted DOCX files using docx4j style/property resolution (unless the application catches StackOverflowError, isolates conversion in disposable worker processes, restarts workers cleanly, and the practical impact is only failure of one request). Severity may be Medium where document upload requires authentication, processing is isolated, or the failure is limited to a single request/worker.\n\n### Credits\nThanks to Koh You Liang ([@Isopach](https://github.com/Isopach)) for responsibly disclosing this issue.",
  "id": "GHSA-gc95-3vw8-vg43",
  "modified": "2026-08-17T21:55:49Z",
  "published": "2026-08-17T21:55:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plutext/docx4j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53752 (GCVE-0-2026-53752)

FKIE_CVE-2026-53752

GHSA-GC95-3VW8-VG43

Summary

Details

Impact

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour