The paper by Coron on bivariate coppersmith in https://iacr.org/archive/crypto2007/46220372/46220372.pdf states the complexity of the algorithm is $O(\log^{11}W)$ where $W$ usually is on order of the number to be factored.
How is this algorithm practical? Has anyone tried this algorithm for $1000$s of bits where the higher order bits of one of the factors is known? Does it run in much better than $O(\log^{11}W)$ bit operations in practical settings?
