docx4j, an open source Java library for manipulating OpenXML documents, had a vulnerability (CVE-2026-53752) in versions before 11.5.14 where the PropertyResolver and related helpers recursively followed the w:basedOn style inheritance chain without detecting cycles. If a DOCX file contains mutually based styles forming a cycle, this causes unbounded recursion in PropertyResolver.fillPPrStack, resulting in a StackOverflowError. This can disrupt server-side document processing by terminating worker threads or degrading thread pools, leading to denial of service. The fix in version 11.5.14 introduces cyclic-style tracking and handles CyclicStylesException to prevent this uncontrolled recursion.

The vulnerability can cause denial of service by triggering a StackOverflowError during server-side processing of maliciously crafted DOCX files with cyclic style inheritance. This can terminate worker threads or degrade thread pools, impacting availability. There is no impact on confidentiality or integrity. The practical effect can be reduced by isolating processing in disposable workers or safely containing StackOverflowError exceptions.

This issue is fixed in docx4j version 11.5.14 by adding cycle detection and exception handling. Users should upgrade to version 11.5.14 or later to remediate this vulnerability. If upgrading is not immediately possible, isolating document processing in disposable worker threads or safely handling StackOverflowError exceptions can reduce the impact.