HIGH 7.5 GitHub
CVE-2026-53752
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
### Summary
docx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chain (`w:basedOn`) without cycle detection.
A WordprocessingML document containing a cyclic style chain (for example, Style A based on B and Style B based on A) causes unbounded recursion and a `java.lang.StackOverflowError` within the property-resolution code path.
These helpers are used by operations that require effective style resolution, including common conversion and TOC
Affected Products
- maven/org.docx4j:docx4j-core <= 11.5.13
References
- https://github.com/advisories/GHSA-gc95-3vw8-vg43
- https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43
- https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14
- https://github.com/advisories/GHSA-gc95-3vw8-vg43
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-17 via GitHub. Affected: maven/org.docx4j:docx4j-core <= 11.5.13.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.