MSRXVulnerabilities / CVE-2009-1537
CVE-2009-1537
Published 2009-05-29 · Analyzed
CVE-2009-1537
Microsoft DirectX NULL Byte Overwrite Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-20, with a fix-by date of 2026-06-03. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
8.8 HIGH
CVSS 3.1 · CNA
CVSS 3.1 · CNA
51%
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
Affected products
- microsoft directx: 9 specific releases listed in NVD
- microsoft windows 2000: all versions
- microsoft windows 2003 server: all versions
- microsoft windows server 2003: all versions
- microsoft windows xp: all versions
Weakness: CWE-158
14 references (advisories, patches, write-ups)
- http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx · Vendor Advisory
- http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx · Vendor Advisory
- http://isc.sans.org/diary.html?storyid=6481 · Not Applicable
- http://osvdb.org/54797 · Broken Link
- http://secunia.com/advisories/35268 · Vendor Advisory
- http://www.microsoft.com/technet/security/advisory/971778.mspx · Patch, Vendor Advisory
- http://www.securityfocus.com/bid/35139 · Broken Link
- http://www.securitytracker.com/id?1022299 · Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-195A.html · US Government Resource
- http://www.vupen.com/english/advisories/2009/1445 · Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1886 · Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 · Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237 · Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537 · US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.