The NCalc expression evaluator computes factorials without bounds. In releases before 6.1.1, crafted expressions with very large factorial operands trigger infinite loops or extreme CPU usage because the factorial calculation overflows and never finishes. This results in a resource exhaustion denial‑of‑service condition. The flaw is a classic integer overflow and infinite loop bug (CWE‑190, CWE‑770). Applications that accept untrusted expressions processed by NCalc are directly vulnerable to this degradation.

The affected product is NCalc from the ncalc vendor. Any deployment using NCalc versions earlier than 6.1.1 is vulnerable. The fix is applied in release 6.1.1, which can be downloaded from the project's releases page.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote or local depending on whether the application feeds untrusted input to NCalc; any user or system component that can inject expressions may trigger the denial of service.