---
id: CVE-2026-53752
title: >-
  docx4j is an open source Java library for creating, editing, and saving
  OpenXML packages, including DOCX, PPTX, and XLSX files
summary: >-
  docx4j is an open source Java library for creating, editing, and saving
  OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14,
  PropertyResolver and adjacent helpers recursively follow the WordprocessingML
  w:basedOn sty…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
  - CWE-770
vendor: plutext
product: docx4j
affected:
  - docx4j < 11.5.14
  - docx4j-core < 11.5.14
patched:
  - 'org.docx4j:docx4j-core 11.5.14'
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T16:17:08.503'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53752'
references:
  - url: >-
      https://github.com/plutext/docx4j/commit/47b528c7dd4c81bcfc8e7fe9df7610c60446f95f
    label: security-advisories@github.com
  - url: >-
      https://github.com/plutext/docx4j/commit/e06cafb334089f0be02e1c63a7c0a602bd44bf06
    label: security-advisories@github.com
  - url: 'https://github.com/plutext/docx4j/releases/tag/docx4j-11.5.14'
    label: security-advisories@github.com
  - url: 'https://github.com/plutext/docx4j/security/advisories/GHSA-gc95-3vw8-vg43'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-gc95-3vw8-vg43'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-16T15:54:10.466468Z'
epss: 0.0063
epssPercentile: 0.47897
aliases:
  - GHSA-gc95-3vw8-vg43
ecosystem: maven
ingestedAt: '2026-08-17T22:01:16.892Z'
---

## Overview

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53752)

Affected packages:

- `org.docx4j:docx4j-core <= 11.5.13`

Patched in:

- `org.docx4j:docx4j-core 11.5.14`

Source: https://github.com/advisories/GHSA-gc95-3vw8-vg43