CVE-2026-53752

docx4j, an open-source Java library for processing DOCX, PPTX, and XLSX files, fails to detect cycles in the WordprocessingML w:basedOn style inheritance chain, so PropertyResolver.fillPPrStack and related effective-style resolution paths recurse without bound. An attacker triggers the flaw by supplying a well-formed DOCX containing mutually-based (circular) styles, which throws a StackOverflowError during conversion or table-of-contents processing. Against a service that processes untrusted documents server-side, this can kill worker threads, degrade a thread pool, and cause denial of service; there is no impact on confidentiality or integrity. Any application embedding docx4j versions prior to 11.5.14 that handles attacker-supplied documents is affected, with the practical impact reduced when documents are handled in disposable, isolated workers. No public proof of concept is known and the issue is not in the CISA KEV catalog, so exploitation appears limited, but the trigger is trivial to construct once understood.

What to do: Upgrade docx4j to 11.5.14, which adds cyclic-style tracking and CyclicStylesException handling. If immediate upgrade is not possible, run untrusted-document conversion in disposable, isolated worker threads (or short-lived processes) so a StackOverflowError cannot exhaust the shared thread pool, and monitor logs for StackOverflowError originating in PropertyResolver.fillPPrStack as an indicator of malformed or hostile style chains.