{"id":"CVE-2026-65160","kind":"vulnerability","aliases":["CVE-2026-65160"],"related":[],"title":"NVIDIA nvJPEG: crafted input can trigger divide-by-zero and crash","description":"NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.","summary":"NVIDIA's nvJPEG image decoding library has a divide-by-zero flaw that an attacker can trigger. Successful exploitation may cause a denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpu","image-processing","nvidia","nvjpeg","runtime"],"not_affected_if":["no-nvjpeg-usage"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T13:17:23+00:00","first_seen_at":"2026-11-03T13:20:53+00:00","triaged_at":"2026-11-03T13:21:34+00:00","updated_at":"2026-11-03T13:21:34+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-03T13:21:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"NVIDIA nvJPEG: crafted input can trigger divide-by-zero and crash","impact":"low","summary":"NVIDIA's nvJPEG image decoding library has a divide-by-zero flaw that an attacker can trigger. Successful exploitation may cause a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["nvidia","nvjpeg","gpu","image-processing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Denial of service: a process crashes or stops responding","analyst_note":"Check the NVIDIA security bulletin for affected nvJPEG versions, fixed versions and the triggering input; the NVD entry alone gives no ranges.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-nvjpeg-usage"],"who_is_affected":"nvJPEG is NVIDIA's GPU-accelerated JPEG library, used by applications that decode or encode JPEG images on NVIDIA hardware. Exposure depends on whether an application in your environment links nvJPEG and accepts untrusted images. The sources do not name affected versions or the exact input that triggers the fault.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":4083,"output_tokens":494,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-65160':15A,18A 'attack':41B,59C 'caus':47B,61C 'contain':54C 'could':60C 'craft':3A 'crash':12A 'cve':13A,16A 'decod':30B 'denial':49B,76C 'divid':8A,35B,64C 'divide-by-zero':7A,34B,63C 'exploit':45B,69C 'flaw':38B 'gpu':19B 'imag':21B,29B 'image-process':20B 'input':4A 'lead':74C 'librari':31B 'may':46B 'might':73C 'nvidia':1A,23B,26B,52C 'nvjpeg':2A,24B,28B,53C 'process':22B 'runtim':25B 'servic':51B,78C 'success':44B,68C 'trigger':6A,43B 'vulner':56C,72C 'zero':10A,37B,66C","nicknames":[],"mitigations":[],"who_affected":"nvJPEG is NVIDIA's GPU-accelerated JPEG library, used by applications that decode or encode JPEG images on NVIDIA hardware. Exposure depends on whether an application in your environment links nvJPEG and accepts untrusted images. The sources do not name affected versions or the exact input that triggers the fault.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gpu","imageprocessing","medium","nvidia","nvjpeg","runtime"],"first_public_at":"2026-11-03T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65160","severity":null,"published_at":"2026-11-03T13:17:23+00:00","modified_at":"2026-11-03T13:17:23+00:00","first_seen_at":"2026-11-03T13:20:53+00:00","fetched_at":"2026-11-03T13:20:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}