HIGH🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2009-1537

CVSS 8.8v2.0pub. 2009-05-29upd. 2026-05-21

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Microsoft Directx

    APP
    Microsoft
    7.07.0a7.18.18.1b9.09.0a9.0b9.0c

  • Microsoft Windows 2000

    OS
    Microsoft
    wszystkie wersje

  • Microsoft Windows 2003 Server

    OS
    Microsoft
    wszystkie wersje

  • Microsoft Windows Server 2003

    OS
    Microsoft
    wszystkie wersje

  • Microsoft Windows Xp

    OS
    Microsoft
    wszystkie wersje

CISA KEV — detailsi

Vendori
Microsoft ↗
Producti
DirectX
Added to KEVi
May 20, 2026
Remediation deadline (US Federal)i
June 3, 2026(overdue)
Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 3 czerwca 2026
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2017-7269CRITICAL9.8⚠ KEVten sam produkt

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (I...

CVE-2014-1776CRITICAL9.8⚠ KEVten sam produkt

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute ar...

CVE-2013-2251CRITICAL9.8⚠ KEVten sam produkt

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a paramet...

CVE-2008-4250CRITICAL9.8⚠ KEVten sam produkt

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1,...

CVE-2019-5620CRITICAL9.8ten sam produkt

ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical...