CISA KEV alertCyberSIXT
CISA Adds 2009 DirectX Flaw to KEV After QuickTime Exploit
CISA has added CVE‑2009‑1537 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft DirectX, specifically the QuickTime Movie Parser Filter in quartz.dll, and is named the Microsoft DirectX NULL Byte Overwrite Vulnerability. It allows remote attackers to execute arbitrary code by supplying a specially crafted QuickTime media file.
The vulnerability resides in the QuickTime Movie Parser Filter within quartz.dll, a component of DirectShow in Microsoft DirectX. An attacker can trigger a NULL byte overwrite by supplying a specially crafted QuickTime media file, which when processed may allow remote code execution with the privileges of the current user. The attack is delivered over the network and requires user interaction to open the malicious file. The vulnerability carries a CVSS v2 base score of 8.8 (High). Microsoft has
AI summary of the CISA Known Exploited Vulnerabilities entry and the NVD record, written automatically by a language model. Read the CISA entry · How summaries are made
Story timeline CVE-2009-1537
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 20 May · 18:02 UTC | CISA | CISA adds seven KEV flaws, including 2026 Microsoft Defender bugs |
| Wed 20 May · 19:33 UTC | CISA | CISA Adds 2009 DirectX Flaw to KEV After QuickTime Exploit (this article) |
| Wed 20 May · 20:13 UTC | CISA | CISA logs CVE-2009-1537 DirectX flaw in KEV catalog |
| Thu 21 May · 21:32 UTC | Security Affairs | CISA Adds Critical Flaws in Windows, Office, Defender to KEV List |