The vulnerability arises from incorrect type conversion and casting in the openexr library's LossyDctDecoder_execute() function. Specifically, when decoding certain compressed EXR image files, the code casts an unaligned uint8_t pointer to a float pointer and writes through it, violating alignment requirements. This leads to undefined behavior, immediate crashes on some CPU architectures, and potential exploitation on others due to compiler optimizations. The issue affects openexr versions >=3.2.0 and <3.2.7, >=3.3.0 and <3.3.9, and >=3.4.0 and <3.4.9. The vendor has fixed the vulnerability in versions 3.2.7, 3.3.9, and 3.4.9.

This vulnerability can cause application crashes on architectures that enforce strict memory alignment, such as ARM and RISC-V, leading to denial of service. On x86 architectures, the undefined behavior may be exploited due to compiler optimizations assuming aligned memory access, potentially leading to memory corruption or other unintended behavior. The CVSS score of 7.1 reflects a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There are no known exploits in the wild at this time.

A fix is available and has been released in openexr versions 3.2.7, 3.3.9, and 3.4.9. Users and organizations should upgrade to one of these fixed versions to remediate the vulnerability. Patch status is confirmed by the vendor's versioning information. No additional mitigation steps are indicated by the vendor advisory.