CVE-2026-55254

Katalog CVE

CVSS 6.5 · Medium EPSS 0,29%

Kerentanan Integer Overflow or Wraparound pada ncalc. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

NCalc is a fast, lightweight expression evaluator for .NET. Prior to 6.1.1, the factorial operator implementation in src/NCalc.Core/Helpers/MathHelper.cs permits specially crafted expressions with extremely large factorial operands, causing excessive CPU consumption or a non-terminating loop due to integer overflow in the factorial calculation logic when applications evaluate untrusted expressions. This issue is fixed in version 6.1.1.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ncalc/ncalc/security/advisories/GHSA-3w5p-95mh-gq75 patch · advisory vendor
• https://github.com/ncalc/ncalc/commit/eeb6155ee1899b1fdf2cda3da35a4f0ca93ffd6a patch
• https://github.com/ncalc/ncalc/pull/575 issue tracking · patch
• https://github.com/ncalc/ncalc/releases/tag/v6.1.1 product · release notes