Executive brief
NCalc is a library used by .NET applications to evaluate mathematical expressions. A flaw in how it handles factorial calculations allows an attacker to provide a specially crafted expression that causes the application to consume excessive CPU or enter an infinite loop. This can lead to a denial-of-service (DoS) condition, making the application unresponsive to legitimate users.
Technical details
A denial-of-service vulnerability exists in NCalc's factorial operator implementation within `MathHelper.cs`. The root cause is a lack of input validation for factorial operands, combined with integer overflow in the calculation logic. An attacker can exploit this by submitting expressions with extremely large values (e.g., 1.5e16!), which triggers a non-terminating loop or excessive resource consumption. The attack requires the application to evaluate untrusted expressions and, according to the CVSS vector, involves high complexity and adjacent network access with user interaction. The issue is resolved in version 6.1.1 by implementing a maximum input bound (set to 170) for factorial operations.
Affected products
- ncalc NCalc.Core < 6.1.1
- ncalc NCalcSync < 6.1.1
Timeline
- 2026-06-11: patched: Fix committed and version 6.1.1 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD