CVE-2009-1537

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.514 · 99 %ileEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

51.4% (99th) EPSS

CVSS 9.3 · high

Is it mine?

17 products

Check your exposure

Who says so?

3 sources

enisa_euvd · fstec_bdu · nvd

added 2026-05-20remediate by 2026-06-03

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

Microsoft DirectX NULL Byte Overwrite Vulnerability

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

cvss

Technical severity, 0–10. One row per scoring source.

9.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 10

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-121USCWE-158USCWE-158USCWE-626US

affected products (17)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Microsoft Corp DirectX≤ 9.0fstec_bduRU
Microsoft Corp DirectX≤ 8.1fstec_bduRU
Microsoft Corp DirectX≤ 7.0fstec_bduRU
microsoft directx= 7.0nvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 7.0anvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 7.1nvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 8.1nvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 8.1bnvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 9.0nvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 9.0anvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 9.0bnvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft directx= 9.0cnvdUScpe:2.3:a:microsoft:directx:*:*:*:*:*:*:*:*
microsoft windows 2000all versionsnvdUScpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*
microsoft windows 2003 serverall versionsnvdUScpe:2.3:o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
microsoft windows server 2003all versionsnvdUScpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
microsoft windows xpall versionsnvdUScpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2009-05-29modified 2026-06-16

references (27)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan