Description

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T18:17:51.773Z",
  "pubdate": "2026-09-14T18:17:51.773Z",
  "executiveSummary": "The docx4j library is susceptible to an infinite recursion vulnerability within its style resolution engine, specifically impacting the PropertyResolver component. This issue occurs when processing maliciously crafted OpenXML files containing circular style dependencies. By exploiting the lack of cycle detection in the w:basedOn style inheritance chain, an attacker can trigger a StackOverflowError during document parsing or conversion processes. This vulnerability poses a significant denial-of-service risk for systems utilizing docx4j to process untrusted documents, such as server-side document converters, report generators, or table-of-contents extraction services. Successful exploitation results in the immediate termination of the worker thread processing the document, potentially leading to thread pool exhaustion and service degradation. The vulnerability affects all versions of docx4j prior to 11.5.14. No authentication or specific privileges are required, as the exploit is embedded within the document structure itself. To mitigate this risk, users must upgrade to version 11.5.14 or later, which introduces robust cycle detection and specialized exception handling to manage non-terminating style resolution chains.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the PropertyResolver.fillPPrStack function and associated effective-style resolution logic within the docx4j library. When parsing a WordprocessingML document, the library resolves style attributes by traversing the 'w:basedOn' hierarchy. The implementation recursively follows these pointers to compute the final effective properties for a document element without performing any cycle detection or depth-limiting checks.\nAn attacker can exploit this by crafting a DOCX file with a set of mutually dependent styles, where a style refers back to itself or creates a closed-loop reference chain through the inheritance tree. When the application attempts to resolve the effective properties for an element linked to this circular chain, the recursive calls in the stack frame continue indefinitely. Since the recursion is unbounded, it inevitably exceeds the JVM stack memory capacity, resulting in a StackOverflowError.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious DOCX file containing a recursive 'w:basedOn' dependency chain. 2) The file is uploaded to or processed by a server-side component utilizing the vulnerable docx4j library. 3) The server attempts to parse the document or generate a table of contents, triggering the PropertyResolver to resolve style inheritance. 4) The library enters an infinite loop, consuming the stack until a StackOverflowError occurs. 5) The specific worker thread running the conversion crashes. If an attacker submits multiple such payloads, they can systematically deplete the application's thread pool, leading to a denial-of-service condition for the entire service.\nThis vulnerability is particularly dangerous in high-concurrency environments or shared document processing pipelines where isolation between threads may be minimal. Even if a host environment attempts to contain the StackOverflowError, the resource exhaustion caused by repeated failed threads can cause instability. The remediation in version 11.5.14 introduces cyclic-style tracking, which monitors the traversal path during resolution, and includes a specific CyclicStylesException handler to abort processing safely before memory or stack resources are exhausted."
}