CVE-2026-53752: docx4j OpenXML Library DOS Vulnerability

CVE-2026-53752 Overview

docx4j is an open source Java library for creating, editing, and saving OpenXML packages including DOCX, PPTX, and XLSX files. Versions prior to 11.5.14 contain an uncontrolled recursion flaw [CWE-674] in PropertyResolver and adjacent helpers that walk the WordprocessingML w:basedOn style inheritance chain without cycle detection. A crafted DOCX with mutually based styles triggers unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, producing a StackOverflowError. Server-side conversion and table-of-contents processing of untrusted documents can terminate worker threads and deny service.

Critical Impact
An unauthenticated attacker can submit a malformed DOCX to any server that uses docx4j for conversion or rendering, causing StackOverflowError conditions that exhaust worker threads and disrupt document processing pipelines.

Affected Products

docx4j versions prior to 11.5.14
Applications performing server-side DOCX, PPTX, or XLSX conversion using docx4j
Systems using docx4j for table-of-contents generation or effective-style resolution

Discovery Timeline

2026-09-14 - CVE-2026-53752 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-53752

Vulnerability Analysis

The vulnerability resides in docx4j's style resolution logic. WordprocessingML permits styles to reference a parent through the w:basedOn element, forming an inheritance chain that docx4j walks recursively to compute effective properties. The library trusted the chain to be acyclic and performed no tracking of previously visited style identifiers.

When PropertyResolver.fillPPrStack and adjacent helpers encounter styles that reference each other in a loop, the recursive descent never terminates. Each call frame consumes stack space until the JVM raises a StackOverflowError. Because DOCX parsing and conversion typically occur inside a request-serving worker thread, the error terminates that thread and can progressively degrade a bounded thread pool.

The practical severity depends on containment. Deployments that isolate parsing in disposable workers or catch StackOverflowError at a safe boundary limit the blast radius. Shared JVMs without such isolation face straightforward denial of service.

Root Cause

The root cause is missing cycle detection during style inheritance traversal. The style resolver treated w:basedOn chains as trees and recursed unconditionally. The fix introduces cyclic-style tracking and a new CyclicStylesException that is raised when a previously visited style is encountered.

Attack Vector

The attack requires no authentication and no user interaction beyond submitting a document to a service that processes DOCX input. An attacker crafts a DOCX containing two or more styles whose w:basedOn values point back to each other, then uploads the file to a conversion endpoint, table-of-contents renderer, or any workflow that invokes docx4j's effective-style resolution.

java

// Patch: introduces CyclicStylesException and cyclic-style tracking
// docx4j-core/src/main/java/org/docx4j/model/styles/StyleTree.java
 import org.docx4j.XmlUtils;
 import org.docx4j.jaxb.Context;
+import org.docx4j.model.PropertyResolver;
+import org.docx4j.openpackaging.exceptions.CyclicStylesException;
 import org.docx4j.openpackaging.exceptions.Docx4JException;
 import org.docx4j.openpackaging.packages.WordprocessingMLPackage;
 import org.docx4j.openpackaging.parts.WordprocessingML.StyleDefinitionsPart;

// docx4j-core/src/main/java/org/docx4j/convert/out/common/AbstractExporter.java
 import org.docx4j.convert.out.AbstractConversionSettings;
+import org.docx4j.openpackaging.exceptions.CyclicStylesException;
 import org.docx4j.openpackaging.exceptions.Docx4JException;
 import org.docx4j.openpackaging.packages.OpcPackage;

Source: docx4j commit 47b528c and commit e06cafb

Detection Methods for CVE-2026-53752

Indicators of Compromise

Repeated java.lang.StackOverflowError entries in application logs referencing org.docx4j.model.PropertyResolver.fillPPrStack or related style-resolution frames.
Worker threads terminating during DOCX conversion, TOC generation, or PDF/HTML export operations.
Sudden thread-pool exhaustion or HTTP 5xx responses from document processing endpoints shortly after untrusted uploads.

Detection Strategies

Inspect uploaded DOCX files for styles.xml entries where two or more w:style elements reference each other via w:basedOn, forming a cycle.
Instrument the docx4j processing path to record document identifiers preceding any StackOverflowError, enabling forensic correlation.
Monitor JVM crash frequency and stack traces originating in org.docx4j.model.styles and org.docx4j.convert.out packages.

Monitoring Recommendations

Enable metrics on document conversion latency and failure rate; alert on sharp deviations that correlate with specific upload sources.
Track thread-pool saturation and rejected task counts for services performing docx4j-based rendering.
Retain uploaded documents that trigger conversion failures for offline analysis and signature development.

How to Mitigate CVE-2026-53752

Immediate Actions Required

Upgrade docx4j to version 11.5.14 or later, which adds cyclic-style tracking and CyclicStylesException handling.
Audit build manifests, Maven/Gradle dependency trees, and shaded JARs for transitive docx4j inclusions below 11.5.14.
Add defensive try/catch blocks around docx4j conversion calls to contain StackOverflowError and CyclicStylesException at request boundaries.

Patch Information

The fix is delivered in docx4j release 11.5.14. Technical background is available in GitHub Security Advisory GHSA-gc95-3vw8-vg43. The patch commits 47b528c and e06cafb introduce visited-style tracking and propagate the new CyclicStylesException through exporters.

Workarounds

Process untrusted DOCX files inside disposable worker processes so a StackOverflowError cannot degrade the primary JVM thread pool.
Pre-validate uploaded documents by parsing word/styles.xml and rejecting files whose w:basedOn graph contains cycles.
Enforce request timeouts and per-document memory limits on conversion endpoints to bound the impact of pathological inputs.

bash

# Maven: pin docx4j to the patched version
mvn dependency:tree | grep docx4j
# Update pom.xml
# <dependency>
#   <groupId>org.docx4j</groupId>
#   <artifactId>docx4j-core</artifactId>
#   <version>11.5.14</version>
# </dependency>
mvn -U clean package