Microsoft · DirectX
CVE-2009-1537
Microsoft DirectX NULL Byte Overwrite Vulnerability
What it is
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
CISA: Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: June 3, 2026
- Added to the CISA list
- May 20, 2026
- Published
- May 29, 2009
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 51% in the top 1.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (13)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028
- http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237
- http://secunia.com/advisories/35268
- http://www.securitytracker.com/id?1022299
- http://www.vupen.com/english/advisories/2009/1886
- http://www.vupen.com/english/advisories/2009/1445
- http://osvdb.org/54797
- http://www.securityfocus.com/bid/35139
- http://www.us-cert.gov/cas/techalerts/TA09-195A.html
- http://isc.sans.org/diary.html?storyid=6481
- http://www.microsoft.com/technet/security/advisory/971778.mspx
- http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsof…
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 13, 2026 | Command Injection | Windows | High 8.8 | 9.8% |
| Sep 25, 2026 | Code Injection | SharePoint | High 8.8 | 8.2% |
| Sep 8, 2026 | Link Following | Windows | High 7.8 | 0.4% |
| Sep 8, 2026 | Heap-Based Buffer Overflow | Windows | High 7.8 | 0.4% |
| Aug 26, 2026 | Remote Code Execution | SQL Server | High 8.8 | 57% |
| Aug 18, 2026 | Double Free | Internet Key Exchange (IKE) Service Extensions | Critical 9.8 | 77% |
| Aug 18, 2026 | Weak Authentication | SharePoint | Critical 9.1 | 70% |
| Aug 11, 2026 | Windows Ancillary Function Driver for WinSock Use-After-Free | Windows Ancillary Function Driver for WinSock | High 7.0 | 0.3% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.