CVE-2026-53752: 
Java vulnerability analysis and mitigation

CVE-2026-53752 is a Denial of Service vulnerability in docx4j's PropertyResolver and adjacent helpers caused by unbounded recursion when traversing cyclic OpenXML style inheritance chains (w:basedOn). Affecting org.docx4j:docx4j-core versions up to and including 11.5.13, the flaw was responsibly disclosed by Koh You Liang (@Isopach), published by plutext on July 7, 2026, and added to the GitHub Advisory Database on August 17, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is uncontrolled recursion (CWE-674) combined with allocation of resources without limits or throttling (CWE-770). The PropertyResolver.fillPPrStack method recursively follows the w:basedOn style inheritance chain without any cycle detection; when a crafted DOCX contains a circular reference (e.g., Style A based on Style B, Style B based on Style A), the method recurses indefinitely until the JVM throws a java.lang.StackOverflowError. The vulnerable code path is triggered by any operation requiring effective style resolution, including document conversion and table-of-contents (TOC) generation. No authentication or special privileges are required — an attacker only needs to submit a malformed but well-formed OOXML file that passes standard antivirus and content-inspection checks (GitHub Advisory, docx4j Advisory).

Exploitation results in a java.lang.StackOverflowError that terminates the processing thread, which can crash worker threads, degrade thread pools, or destabilize containerized and serverless environments — bypassing typical per-request CPU and heap-memory safeguards because the failure mode is thread-stack exhaustion rather than gradual resource consumption. There is no confidentiality or integrity impact; the sole consequence is availability loss. Repeated submission of a crafted file can sustain a denial-of-service condition against any server-side pipeline that accepts and processes user-supplied DOCX files through docx4j (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable against exposed endpoints. The CVE status is currently Reserved, and it does not appear in the CISA Known Exploited Vulnerabilities catalog. No EPSS score is currently published (GitHub Advisory).

1. Craft a malicious DOCX file: Create a valid OOXML (.docx) package and edit the word/styles.xml component to introduce a cyclic w:basedOn reference — for example, define Style A with <w:basedOn w:val="StyleB"/> and Style B with <w:basedOn w:val="StyleA"/>. The file remains a well-formed OOXML package and will pass standard content inspection.
2. Identify a target endpoint: Locate a server-side application that accepts DOCX file uploads and processes them using docx4j (e.g., document conversion services, TOC generation APIs, or report-generation pipelines) running org.docx4j:docx4j-core version ≤ 11.5.13.
3. Submit the file: Upload the crafted DOCX via the application's file upload interface (HTTP POST, API endpoint, etc.). No authentication is required if the endpoint is publicly accessible.
4. Trigger unbounded recursion: When docx4j processes the file and invokes PropertyResolver.fillPPrStack (or adjacent helpers) during style resolution, the cyclic chain causes infinite recursion, resulting in a java.lang.StackOverflowError that terminates the worker thread.
5. Sustain the DoS: Repeat submissions to exhaust the thread pool or continuously crash worker processes, rendering the service unavailable (GitHub Advisory, docx4j Advisory).

• Logs: Java application logs containing java.lang.StackOverflowError stack traces originating from org.docx4j.model.PropertyResolver.fillPPrStack or adjacent style-resolution methods; repeated errors correlated with DOCX file upload events.
• Application Behavior: Sudden termination or restart of worker threads/processes immediately following a DOCX upload; degraded thread pool availability or increased request failure rates on document-processing endpoints.
• File System: Uploaded DOCX files whose word/styles.xml contains mutually referencing <w:basedOn> elements forming a cycle — detectable via static analysis of the OOXML package contents.
• Network: Repeated HTTP POST requests to document upload or conversion endpoints from the same source IP, particularly if each request results in a server error response (HTTP 500) (GitHub Advisory).

Upgrade org.docx4j:docx4j-core to version 11.5.14, which introduces cycle detection in the style inheritance traversal and resolves the unbounded recursion (docx4j Release). As interim mitigations where immediate upgrade is not possible: restrict DOCX upload endpoints to authenticated users to raise the attack bar; isolate docx4j processing in disposable worker processes that are restarted on failure to limit blast radius; and implement application-level StackOverflowError catching to prevent full thread-pool exhaustion. Pre-processing validation of uploaded DOCX files to detect cyclic w:basedOn references in word/styles.xml can also serve as a defense-in-depth measure (GitHub Advisory).

The vulnerability was responsibly disclosed by security researcher Koh You Liang (@Isopach) and coordinated with the plutext maintainers prior to public disclosure. The advisory notes that detection is particularly difficult because the malicious file is a well-formed OOXML package that passes standard antivirus and content-inspection rules, highlighting a broader challenge in file-processing security. No significant media coverage or notable community debate beyond the advisory itself has been identified at this time (GitHub Advisory).