CVE-2026-53752docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
- 7.5HighCVSS base score
- 0.63%Exploitation in 30 daysEPSS · top 49% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.
Timeline
ID reserved
By GitHub_M
- 3 months later
· 3 months later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.63% · top 49% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected < 11.5.14
- affected < 11.5.14
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.docx4j:docx4j-coreGHSA-gc95-3vw8-vg43 (opens in a new tab)
References
References4
- https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f (opens in a new tab)x_refsource_MISC
- https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06 (opens in a new tab)x_refsource_MISC
- https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-77696 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-gc95-3vw8-vg43 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-53752)Record last updated .