← All Advisories

CVE-2009-1537: Microsoft DirectX NULL Byte

Status: KEV  |  Advisory ID: CVE-2009-1537

Key Details

CVECVE-2009-1537
Affected productsMicrosoft DirectX
Exploitation statusListed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation.
KEV listingAdded to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-05-20.
Exploitation prediction (EPSS)51% probability of exploitation in the next 30 days (99% percentile) -- FIRST.org's EPSS model.
Federal remediation deadline2026-06-03 (CISA KEV, Binding Operational Directive).

What to Know

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2009-1537