Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-55254

NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

Description

NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causing excessive CPU consumption or a non-terminating loop due to integer overflow in the factorial calculation logic when applications evaluate untrusted expressions. This issue is fixed in version 6.1.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ncalc ncalc

  • < 6.1.1affected

References