NVIDIA nvJPEG CVE-2026-65160

Exploitation requires that an application built on NVIDIA nvJPEG decode an attacker-controlled JPEG image; the specific malformed field that triggers the divide-by-zero is not described in the available sources beyond the CWE-369 classification. Limiting factors are significant: the CVSS vector is AV:L (local - the crafted input must reach a locally running nvJPEG consumer) and UI:R (a user or application must actively process the malicious file), and impact is confined to availability (C:N/I:N/A:H), i.e. a crash/DoS with no code execution or data exposure. Realistic exposure is limited to environments that feed untrusted images into nvJPEG-based decoding (image services, ML preprocessing); systems that only process trusted local images are effectively not at risk.

This is a moderate-severity availability-only issue, not a top-priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local attack that requires user interaction and yields only a denial of service (A:H) with no confidentiality or integrity impact - consistent with the CWE-369 divide-by-zero and the stated DoS outcome. Although PR:N makes it nominally unauthenticated, exploitation is gated by UI:R: a user must process attacker-supplied input through nvJPEG, so this behaves like a malicious-file-handling bug rather than a remotely reachable service flaw. No EPSS score is provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no public exploit reference in the input, so there is no active-exploitation signal. The vuln.today decision label is 'this_month', indicating routine prioritization rather than act_now/emergency. Net: a legitimate crash/DoS bug worth patching on a normal cycle, not a widely-exploited critical. Note the local-only vector means it is only meaningful where untrusted images are fed into nvJPEG-based pipelines.

An attacker crafts a malformed JPEG with dimension or sampling-factor fields that cause a divide-by-zero inside nvJPEG, then gets a victim application or user to decode it (e.g. an image-processing or ML preprocessing pipeline that accepts user-uploaded images). When nvJPEG processes the crafted file, the divide-by-zero triggers and the process crashes, denying service. No public exploit code is referenced in the available data.