OpenEXR interprets DWA or DWAB compressed EXR files as part of the reference implementation for the motion‑picture industry's image format. In versions 3.2.0 through 3.2.6, 3.3.8 and 3.4.8 the function that decodes these compressed channels performs an in‑place conversion from HALF to FLOAT. The code incorrectly casts an unaligned 8‑byte pointer to a floating‑point reference and writes through it. This misaligned memory write triggers undefined behavior according to the C standard. On architectures that enforce 4‑byte alignment, the failure manifests as a crash; on x86 the operation is tolerated but may still be exploited by compiler optimizations that assume aligned access, potentially corrupting data or causing a denial of service.

Any software that bundles the Academy Software Foundation’s OpenEXR library versions 3.2.0 to 3.2.6, 3.3.0 to 3.3.8 and 3.4.0 to 3.4.8, and that processes DWA or DWAB compressed images with FLOAT‑type channels, is vulnerable. This includes the open source binaries supplied by the foundation as well as third‑party applications that embed the library. The vulnerability is fixed in releases 3.2.7, 3.3.9 and 3.4.9.

The CVSS scoring indicates a high severity (7.1). However, the EPSS score is below 1 %, suggesting that active exploitation is unlikely at present. The vulnerability does not appear in CISA’s KEV list, implying no publicly known active exploits. Attackers would need to supply a crafted EXR file that the vulnerable decoder processes. On aligned‑enforcing processors the outcome is a predictable crash, giving the system an immediate denial of service. On processors that tolerate alignment, the risk depends on whether compiler optimizations lead to corruption or uncontrolled execution, which is less certain. In either case, the impact is confined to the application's runtime and does not provide remote code execution to external attackers.