CVE-2026-55254

EUVD-2026-45304
NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causing excessive CPU consumption or a non-terminating loop due to integer overflow in the factorial calculation logic when applications evaluate untrusted expressions. This issue is fixed in version 6.1.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.8 MEDIUM
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.84%
Affected Products (NVD)
VendorProductVersion
ncalcncalc
𝑥
< 6.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/ncalc/ncalc/commit/eeb6155ee1899b1fdf2cda3da35a4f0ca93ffd6a
https://github.com/ncalc/ncalc/pull/575
https://github.com/ncalc/ncalc/releases/tag/v6.1.1
https://github.com/ncalc/ncalc/security/advisories/GHSA-3w5p-95mh-gq75