{"id":"CVE-2026-53752","aliases":["EUVD-2026-77696","GHSA-gc95-3vw8-vg43"],"status":"published","title":"docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service","description":"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0063,"percentile":0.50519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-770"],"published":"2026-08-17T21:55:49Z","modified":"2026-10-28T10:52:02Z","fixes":[{"ecosystem":"Maven","package":"org.docx4j:docx4j-core","fixed_in":["11.5.14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.docx4j:docx4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"11.5.13"},{"fixed":"11.5.14"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.docx4j:docx4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.14"}]}],"versions":["11.1.0","11.1.2","11.1.3","11.1.7","11.1.8","11.2.5","11.2.8","11.2.9","11.3.2","11.4.10","11.4.11","11.4.5","11.4.6","11.4.7","11.4.8","11.4.9","11.5.0","11.5.1","11.5.10","11.5.11","11.5.12","11.5.13","11.5.2","11.5.3","11.5.4","11.5.5","11.5.6","11.5.7","11.5.8","11.5.9","8.0.0","8.1.0","8.1.1","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.2.6","8.2.7","8.2.8","8.2.9","8.3.0","8.3.1","8.3.10","8.3.11","8.3.12","8.3.13","8.3.14","8.3.15","8.3.2","8.3.3","8.3.4","8.3.7","8.3.8","8.3.9"]}],"products":[{"vendor":"org.docx4j","product":"docx4j-core"},{"vendor":"plutext","product":"docx4j"}],"references":[{"url":"https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-gc95-3vw8-vg43"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53752.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53752","tags":["advisory"]},{"url":"https://github.com/plutext/docx4j","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53752","title":"docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service","description":"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.","status":"published","published":"2026-09-14T17:31:07.287Z","modified":"2026-09-16T15:54:21.969Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-77696","description":"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.","status":"published","published":"2026-09-14T17:31:07Z","modified":"2026-09-16T15:54:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:15.407859Z"}],"ghsa":[{"id":"GHSA-gc95-3vw8-vg43","title":"docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service","description":"### Summary\ndocx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chain (`w:basedOn`) without cycle detection. \n\nA WordprocessingML document containing a cyclic style chain (for example, Style A based on B and Style B based on A) causes unbounded recursion and a `java.lang.StackOverflowError` within the property-resolution code path.\n\nThese helpers are used by operations that require effective style resolution, including common conversion and TOC-related paths.  As a result, most server-side pipelines that accept a user-supplied docx and process it through docx4j can likely be crashed by a file containing a cyclic style reference.\n\n### Details\n\nRepresentative snippet: `PropertyResolver.fillPPrStack`\n\n```java\nprivate void fillPPrStack(String styleId, Stack\u003cPPr\u003e pPrStack) {\n    Style style = liveStyles.get(styleId);\n    ...\n    // if it is based on, recurse\n    if (style.getBasedOn() == null) {\n        log.debug(\"Style \" + styleId + \" is a root style.\");\n    } else if (style.getBasedOn().getVal() != null) {\n        String basedOnStyleName = style.getBasedOn().getVal();\n        fillPPrStack(basedOnStyleName, pPrStack);   // ← unbounded recursion\n        ...\n```\n\n### Impact\nThis is a denial of service against a server-side application that processes untrusted docx files via docx4j. \n\nAn upload causes the processing thread to be terminated with `StackOverflowError` which may crash the worker thread, degrade the thread pool, or evade normal per-request CPU and heap-memory safeguards in containers and serverless functions (because the failure mode is thread-stack exhaustion rather than gradual resource consumption).\n\nThe attack depends on the host application's access controls and requires no user interaction beyond submitting the file. Detection is difficult because the file is a well-formed OOXML package containing ordinary style elements,  and passes standard antivirus and content-inspection rules.\n\nSeverity: High for server-side applications that process untrusted DOCX files using docx4j style/property resolution (unless the application catches StackOverflowError, isolates conversion in disposable worker processes, restarts workers cleanly, and the practical impact is only failure of one request). Severity may be Medium where document upload requires authentication, processing is isolated, or the failure is limited to a single request/worker.\n\n### Credits\nThanks to Koh You Liang ([@Isopach](https://github.com/Isopach)) for responsibly disclosing this issue.","status":"published","published":"2026-08-17T21:55:49Z","modified":"2026-08-17T21:55:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-53752","description":"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.","status":"published","published":"2026-09-14T18:17:51.773Z","modified":"2026-09-30T17:43:24.057Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-53752","title":"docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service","description":"docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.","status":"published","published":"2026-09-14T17:31:07.287Z","modified":"2026-10-28T10:52:02.987982567Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-gc95-3vw8-vg43","title":"docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service","description":"### Summary\ndocx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chain (`w:basedOn`) without cycle detection. \n\nA WordprocessingML document containing a cyclic style chain (for example, Style A based on B and Style B based on A) causes unbounded recursion and a `java.lang.StackOverflowError` within the property-resolution code path.\n\nThese helpers are used by operations that require effective style resolution, including common conversion and TOC-related paths.  As a result, most server-side pipelines that accept a user-supplied docx and process it through docx4j can likely be crashed by a file containing a cyclic style reference.\n\n### Details\n\nRepresentative snippet: `PropertyResolver.fillPPrStack`\n\n```java\nprivate void fillPPrStack(String styleId, Stack\u003cPPr\u003e pPrStack) {\n    Style style = liveStyles.get(styleId);\n    ...\n    // if it is based on, recurse\n    if (style.getBasedOn() == null) {\n        log.debug(\"Style \" + styleId + \" is a root style.\");\n    } else if (style.getBasedOn().getVal() != null) {\n        String basedOnStyleName = style.getBasedOn().getVal();\n        fillPPrStack(basedOnStyleName, pPrStack);   // ← unbounded recursion\n        ...\n```\n\n### Impact\nThis is a denial of service against a server-side application that processes untrusted docx files via docx4j. \n\nAn upload causes the processing thread to be terminated with `StackOverflowError` which may crash the worker thread, degrade the thread pool, or evade normal per-request CPU and heap-memory safeguards in containers and serverless functions (because the failure mode is thread-stack exhaustion rather than gradual resource consumption).\n\nThe attack depends on the host application's access controls and requires no user interaction beyond submitting the file. Detection is difficult because the file is a well-formed OOXML package containing ordinary style elements,  and passes standard antivirus and content-inspection rules.\n\nSeverity: High for server-side applications that process untrusted DOCX files using docx4j style/property resolution (unless the application catches StackOverflowError, isolates conversion in disposable worker processes, restarts workers cleanly, and the practical impact is only failure of one request). Severity may be Medium where document upload requires authentication, processing is isolated, or the failure is limited to a single request/worker.\n\n### Credits\nThanks to Koh You Liang ([@Isopach](https://github.com/Isopach)) for responsibly disclosing this issue.","status":"published","published":"2026-08-17T21:55:49Z","modified":"2026-08-17T22:11:01.639227Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674","CWE-770"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}