Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53752— docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

Quick assessment

Affected
plutext docx4j
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

docx4j 是一个开源的 Java 库，用于创建、编辑和保存 OpenXML 包（包括 DOCX、PPTX 和 XLSX 文件）。在 11.5.14 版本之前， 及其相关辅助类在递归追踪 WordprocessingML 中 样式继承链时，缺乏循环检测机制。如果 DOCX 文档中存在相互引用的样式（即样式 A 基于样式 B，样式 B 又基于样式 A 或自身），会导致 及相关有效样式解析路径中出现无界递归，从而引发 。 在服务器端转换或处理目录时，若处理不可信的文档，可能导致工作线程异常终止、线程池性能下降或服务中

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
org.docx4j docx4j-core < 11.5.14 affected
plutext docx4j < 11.5.14 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53752

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
plutext docx4j < 11.5.14 -
org.docx4j docx4j-core < 11.5.14 -

II. Public POCs for CVE-2026-53752

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53752

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53752 (1)

Vendor Pages for CVE-2026-53752 (1)

IV. Related Vulnerabilities

Same weakness: CWE-674

V. Comments for CVE-2026-53752

No comments yet

Leave a comment