Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The QuickTime movie parser in Microsoft DirectX's DirectShow component affects older Windows operating systems. A remote attacker could run arbitrary code on an affected system by supplying a specially crafted QuickTime media file.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 13
docs.microsoft.com
blogs.technet.com
oval.cisecurity.org
secunia.com
securitytracker.com
osvdb.org
securityfocus.com
us-cert.gov
isc.sans.org
microsoft.com
Questions about CVE-2009-1537
What does this mean?
A flaw in how the QuickTime Movie Parser Filter in DirectShow (quartz.dll) reads QuickTime media files can allow code to run if a user opens a specially crafted QuickTime file. The code runs with the same rights as the local user, and with administrative rights an attacker could take complete control of the system.Source: learn.microsoft.com
Am I affected, and how do I check?
The advisory lists DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2/SP3, and Windows Server 2003 SP2. Windows Vista and Windows Server 2008 are not affected. To check a system, look at the Windows version and service pack, and the DirectX version reported by the dxdiag tool.Source: learn.microsoft.com
What should I do about it?
Install the Microsoft security update that corrects how DirectShow parses QuickTime media files. The facts do not name a specific fixed version to upgrade to.Source: learn.microsoft.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-20, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Disable the parsing of QuickTime content in quartz.dll as a workaround until the security update is installed. Avoid opening QuickTime files from untrusted sources in the meantime.Source: learn.microsoft.com