{"id":"CVE-2009-1537","kind":"vulnerability","aliases":["CVE-2009-1537"],"related":[],"title":"Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0…","description":"Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Microsoft DirectX's DirectShow QuickTime Movie Parser Filter in quartz.dll has a NULL byte overwrite flaw. A remote attacker who supplies a crafted QuickTime media file can execute arbitrary code.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-05-20T00:00:00+00:00","products":[{"name":"Microsoft DirectX","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 7.0a","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 7.1","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 8.1","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 8.1b","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 9.0a","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 9.0b","ecosystem":"vendor"},{"name":"microsoft directx","fixed":[],"affected":"= 9.0c","ecosystem":"vendor"},{"name":"microsoft windows 2000","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 2003 server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2003","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows xp","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["directshow","exploited","microsoft-directx","vendor","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigations referenced by CISA, or discontinue use of the affected product if mitigations are unavailable.","status":"open","published_at":"2009-05-29T18:30:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:06+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:34:06Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations referenced by CISA, or discontinue use of the affected product if mitigations are unavailable.","summary":"Microsoft DirectX's DirectShow QuickTime Movie Parser Filter in quartz.dll has a NULL byte overwrite flaw. A remote attacker who supplies a crafted QuickTime media file can execute arbitrary code.","category":"vendor","who_cares":["windows","microsoft-directx","directshow"],"confidence":0.6,"analyst_note":"Sources give no affected or fixed versions and no vendor patch reference; check Microsoft's security bulletin for CVE-2009-1537 for the patch and the affected Windows builds.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"severity_if_unknown":"high"},"cost_usd":0.000356,"input_tokens":2101,"output_tokens":291,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':139C '-1537':19A,22A '-2009':18A,21A '2000':45A '2003':48A,53A '22':138C '7.0':16A 'action':129C 'allow':114C 'appli':130C 'applic':136C 'arbitrari':92B,119C 'attack':82B,116C 'bod':137C 'byte':77B,99C 'cisa':127C 'cloud':142C 'code':93B,120C 'contain':96C 'could':113C 'craft':86B,123C 'cve':17A,20A 'directshow':12A,57B,67B,111C 'directx':15A,24A,26A,28A,30A,32A,34A,36A,38A,40A,42A,61B,65B,95C 'discontinu':145C 'execut':91B,118C 'exploit':58B 'file':89B,126C 'filter':8A,71B,107C 'flaw':79B 'follow':135C 'guidanc':140C 'instruct':134C 'media':88B,125C 'microsoft':14A,23A,25A,27A,29A,31A,33A,35A,37A,39A,41A,43A,46A,50A,54A,60B,64B,94C 'microsoft-directx':59B 'mitig':131C,151C 'movi':6A,69B,105C 'null':76B,98C 'overwrit':78B,100C 'parser':7A,70B,106C 'per':132C 'product':149C 'quartz.dll':10A,73B,109C 'quicktim':5A,68B,87B,104C,124C 'remot':81B,115C 'requir':128C 'server':49A,52A 'servic':143C 'suppli':84B 'unavail':153C 'unspecifi':1A 'use':146C 'vendor':62B,133C 'via':121C 'vulner':2A,101C 'window':63B 'windows':44A,47A,51A,55A 'xp':56A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2009-05-29T18:30:00+00:00","kev":{"dateAdded":"2026-05-20","dueDate":"2026-06-03","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2009-1537","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2009-1537","severity":null,"published_at":"2026-05-20T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2009-1537","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1537","severity":null,"published_at":"2009-05-29T18:30:00+00:00","modified_at":"2026-06-16T23:07:28+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}