CVE-2007-3901: Microsoft DirectX SAMI Parser Stack Buffer Overflow in quartz.dll

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows remote code execution with a CVSS v2 score of 8.5, public exploit code exists, and EPSS is very high, though it is not listed in CISA KEV.

What it is

A stack-based buffer overflow exists in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll, affecting Microsoft DirectX 7.0 through 10.0. A crafted SAMI file can overflow a stack buffer, allowing remote code execution in the context of the parsing process. The flaw is remotely reachable and carries a high CVSS v2 score of 8.5.

Impact

An attacker who successfully triggers the overflow can execute arbitrary code with the privileges of the user or application processing the SAMI file. This can lead to full compromise of confidentiality, integrity, and availability on the affected host.

Attack surface

The vulnerability is reached over the network by delivering a malicious SAMI file that is parsed by DirectShow. The CVSS vector (AV:N/AC:M/Au:S) indicates network delivery, medium attack complexity, and that some level of authentication or user context is required, with no explicit user interaction stated in the record.

Exploitation

The record does not list this CVE in CISA KEV and provides no ransomware association; EPSS shows a 30-day probability of 0.45873 (98.7th percentile), and a public Exploit-DB entry (4866) exists, indicating exploit code is publicly available.

What to do

• Apply the Microsoft security update MS07-064 for DirectX/quartz.dll as the primary fix.
• Block or restrict delivery of untrusted SAMI files through email, web, and file-sharing channels.
• Disable or unregister the SAMI/DirectShow parsing path where it is not operationally required.
• Enforce least privilege so that media parsing occurs under a low-privilege account.
• Monitor vendor advisories and CERT/CC guidance for any updated workarounds.

Detection

• Monitor for processes loading quartz.dll and subsequently spawning unexpected child processes or making network connections.
• Inspect email and web gateways for SAMI file attachments or downloads and alert on their presence.
• Use endpoint detection to flag crashes or memory corruption events in quartz.dll or DirectShow-related processes.
• Hunt for known public exploit artifacts associated with Exploit-DB 4866 in file or process telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.