plutext docx4j up to 11.5.13 PropertyResolver PropertyResolver.fillPPrStack recursion

Summaryinfo

A vulnerability, which was classified as problematic, was found in plutext docx4j up to 11.5.13. This affects the function PropertyResolver.fillPPrStack of the component PropertyResolver. Executing a manipulation can lead to recursion. This vulnerability is handled as CVE-2026-53752. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in plutext docx4j up to 11.5.13 and classified as problematic. This vulnerability affects the function PropertyResolver.fillPPrStack of the component PropertyResolver. The manipulation with an unknown input leads to a recursion vulnerability. The CWE definition for the vulnerability is CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. As an impact it is known to affect availability. CVE summarizes:

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError. Server-side conversion and table-of-contents processing of an untrusted document can terminate a worker thread, degrade a thread pool, or deny service, although isolation in disposable workers or safe containment of StackOverflowError can reduce the practical effect. The fix adds cyclic-style tracking and CyclicStylesException handling. This issue is fixed in version 11.5.14.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-53752 since 06/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 11.5.14 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• plutext

Name

• docx4j

Version

• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.5.4
• 11.5.5
• 11.5.6
• 11.5.7
• 11.5.8
• 11.5.9
• 11.5.10
• 11.5.11
• 11.5.12
• 11.5.13

Website

• Product: https://github.com/plutext/docx4j/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion