CVE-2026-55254: 
C# vulnerability analysis and mitigation

CVE-2026-55254 is a denial-of-service (DoS) vulnerability in the factorial operator implementation of the NCalc expression evaluation library for .NET. Specially crafted expressions with extremely large factorial operands can trigger excessive CPU consumption or cause evaluation to enter a non-terminating loop due to integer overflow in the factorial calculation logic. The vulnerability affects NCalc.Core and NCalcSync NuGet packages in versions prior to 6.1.1. It was published on June 17, 2026, and has a CVSS v3.1 base score of 4.8 (Moderate) (GitHub Advisory).

The root cause is a combination of integer overflow (CWE-190) and allocation of resources without limits or throttling (CWE-770) in NCalc's factorial operator logic. When an operand such as 99999999999999!, 9223372036854775807!, or 1.5e16! is supplied, the factorial calculation overflows integer bounds, causing the evaluator to loop indefinitely or consume unbounded CPU resources. Exploitation requires that an attacker be able to supply an untrusted expression to an application that evaluates it using NCalc — no authentication or elevated privileges are required, but user interaction and adjacent network access are preconditions per the CVSS scoring. The fix, implemented in pull request #575, adds bounds validation for factorial operands and rejects unsupported values before evaluation (GitHub Advisory, Fix PR #575).

Successful exploitation results in resource exhaustion on the host running the affected application, with high availability impact and no confidentiality or integrity impact. Applications that pass untrusted user input to NCalc's expression evaluator may become unresponsive or crash, causing service disruption. There is no evidence of data exposure or lateral movement potential, as the vulnerability is limited to a DoS condition (GitHub Advisory).

1. Identify target: Locate an application that accepts user-supplied expressions and evaluates them using NCalc.Core or NCalcSync versions prior to 6.1.1 (e.g., a formula input field, a rules engine, or a scripting interface).
2. Craft malicious expression: Prepare a factorial expression with an extremely large operand, such as 99999999999999!, 9223372036854775807!, or 1.5e16!.
3. Submit expression: Submit the crafted expression through the application's input mechanism (e.g., an HTTP request, form field, or API call) that passes the value to NCalc for evaluation.
4. Trigger DoS: The NCalc evaluator processes the factorial, encounters integer overflow, and enters a non-terminating loop or consumes excessive CPU, causing the application to become unresponsive or crash (GitHub Advisory).

• Logs: Application logs showing repeated or long-running expression evaluation requests containing the ! (factorial) operator with very large numeric operands (e.g., values near Int64.MaxValue or floating-point representations like 1.5e16).
• Process: Sustained high CPU utilization by the .NET application process with no corresponding increase in useful throughput; application threads stuck in factorial computation loops.
• Network: Repeated requests to expression evaluation endpoints from the same source, particularly if the application exposes such functionality via an API.

Users should upgrade NCalc.Core and NCalcSync to version 6.1.1 or later, which adds bounds validation for factorial operands and rejects unsupported values before evaluation (GitHub Advisory, Fix PR #575). If immediate upgrade is not possible, the following workarounds can reduce exposure: do not evaluate expressions from untrusted users; validate or sanitize expressions before evaluation and reject factorial operations on large values; and implement execution time limits, request timeouts, or cancellation tokens around expression evaluation calls. These workarounds do not fully address the underlying vulnerability.