Executive brief
docx4j is a Java library used to create and manipulate Microsoft Word documents on servers. A flaw in how it processes document styles allows an attacker to craft a malicious Word file that causes the server to crash when processing it. The file appears normal and bypasses security scanning, but triggers an infinite loop in the style-parsing code that exhausts the thread stack, disrupting service availability and potentially crashing worker processes.
Technical details
The vulnerability is an uncontrolled recursion flaw (CWE-674) in PropertyResolver.fillPPrStack and related style-resolution helpers. These methods recursively traverse the w:basedOn style inheritance chain without detecting cycles. A DOCX containing styles with circular dependencies (Style A → B → A) causes infinite recursion and java.lang.StackOverflowError. The attack vector is network (file upload); no authentication or user interaction is required beyond submitting the file. The file is a well-formed OOXML package that passes antivirus and content-inspection rules. Impact is denial of service: thread termination, worker pool degradation, and evasion of per-request resource limits in containers and serverless environments. Patch available in docx4j 11.5.14.
Affected products
- plutext docx4j-core <= 11.5.13
Timeline
- 2026-07-07: disclosed: Advisory published
- 2026-07-07: patched: Fix available in version 11.5.14