CVE-2026-53752

Name of the Vulnerable Software and Affected Versions docx4j versions prior to 11.5.14

Description PropertyResolver and associated helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX file containing mutually based styles (e.g., Style A based on Style B, and Style B based on Style A) triggers unbounded recursion in the fillPPrStack() function and other effective-style resolution paths. This leads to a java.lang.StackOverflowError, which can terminate worker threads, degrade thread pools, or cause a denial of service in server-side applications performing document conversion or table-of-contents processing. This failure mode involves thread-stack exhaustion, which may bypass standard CPU and heap-memory safeguards in containers or serverless functions.

Recommendations Update docx4j to version 11.5.14 or later.