CVE-2009-1537: Microsoft DirectShow QuickTime Parser NULL Byte Overwrite RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows remote code execution with no privileges required, was exploited in the wild, and is listed in CISA KEV with a near-term remediation due date.

What it is

The QuickTime Movie Parser Filter in quartz.dll (DirectShow, DirectX 7.0 through 9.0c) contains an unspecified NULL byte overwrite flaw. A crafted QuickTime media file can corrupt memory and lead to remote code execution on affected Windows 2000, XP, and Server 2003 systems.

Impact

An attacker who gets a victim to open a malicious QuickTime file can execute arbitrary code in the context of the user or application processing the file. This can result in full system compromise, data theft, or installation of malware.

Attack surface

Reached remotely by delivering a crafted QuickTime media file that is parsed by DirectShow; the CVSS vector indicates network delivery with user interaction required and no privileges needed. No authentication is required, but the victim must open or play the file.

Exploitation

Microsoft and US-CERT references confirm the vulnerability was exploited in the wild in May 2009, and CISA added it to the KEV catalog with a due date of 2026-06-03. EPSS shows a 30-day exploitation probability of 0.51207 (98.9th percentile), indicating high likelihood of active exploitation.

What to do

• Apply the Microsoft security update MS09-028 (or later cumulative DirectX/quartz.dll updates) to all affected Windows 2000, XP, and Server 2003 systems.
• If patching is not immediately possible, follow CISA KEV required actions: apply vendor mitigations or discontinue use of the affected product.
• Block or restrict untrusted QuickTime media files at email gateways, web proxies, and endpoint controls until systems are patched.
• Disable or unregister the QuickTime Movie Parser Filter in quartz.dll where it is not required for business operations.
• Upgrade or retire end-of-life Windows 2000, XP, and Server 2003 systems that cannot receive current security updates.

Detection

• Monitor for processes loading quartz.dll and parsing QuickTime media files, especially from email attachments, downloads, or removable media.
• Hunt for unexpected child processes spawned by media players, browsers, or DirectShow-based applications after opening QuickTime files.
• Review endpoint and network logs for known exploit delivery patterns or C2 callbacks associated with May 2009 in-the-wild exploitation.
• Use file reputation and sandboxing to detonate suspicious QuickTime files and observe memory corruption or code execution behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.