Intel

CVE-2009-1537

Microsoft DirectX — Microsoft DirectX NULL Byte Overwrite Vulnerability

criticalKEV: actively exploitedPoCEPSS 51%

Description

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS v3 score of 8.8 (AV:N/AC:L/PR:N/UI:R) and an EPSS percentile of 98.9 %, this vulnerability sits in the extreme tail of exploitability — virtually no comparable flaw has a higher probability of active exploitation. The attack requires no authentication and only minimal user interaction (opening a media file), making it trivially deliverable via spear-phishing or a malicious web page. Although Windows 2000, XP, and Server 2003 are long past end-of-life, they persist in KRITIS and OT-adjacent environments as non-migratable legacy systems — precisely the exposure profile that makes CISA's 2026 KEV addition operationally significant rather than historical. Any organisation with internet-facing or email-accessible systems still running DirectX 7.0–9.0c should treat this as a critical finding requiring immediate patch deployment or network isolation, ahead of lower-EPSS items in the remediation queue.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Microsoft Security Bulletin MS09-028 addresses CVE-2009-1537 for DirectX 7.0–9.0c on Windows 2000 SP4, Windows XP SP2/SP3, and Windows Server 2003 SP2 — deploy KB971633 (DirectX 7.0), KB971634 (DirectX 8.1), and KB971644 (DirectX 9.0c) via Windows Update or WSUS without delay.
  • Isolate unpatched systems: Segment any affected endpoint (Windows 2000/XP/Server 2003) from the internet and from internal network zones until the patch is confirmed installed.
  • Block QuickTime file-type associations: Disable or GPO-lock the file-type mappings for .mov, .qt, and .moov on all affected systems to prevent accidental opening of crafted media files.
  • Configure the email gateway and web proxy to block download of .mov, .qt, and .moov files destined for affected endpoints.
  • Rotate credentials for privileged accounts on affected systems and terminate active administrator sessions if compromise cannot be ruled out.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move affected legacy systems (Windows 2000/XP/Server 2003) into an isolated VLAN; force all outbound HTTP/HTTPS traffic through a proxy with content inspection.
  • WAF/IPS rule: Enable Snort/Suricata signatures targeting QuickTime files with anomalous NULL-byte sequences in the atom header — check the Emerging Threats ruleset (SID range 2009xxx) for CVE-2009-1537 coverage.
  • Application control: Use Software Restriction Policies (SRP) to prevent quartz.dll-based parsers from loading outside authorised system paths.
  • Least privilege / IAM: Ensure browsers and media players on affected systems run under restricted user accounts, not administrator-level tokens; enforce this via local policy on Windows XP where UAC is unavailable.
  • ActiveX hardening: In Internet Explorer on affected systems, disable ActiveX execution for QuickTime in the Internet Zone — this blocks the primary drive-by delivery vector via browser.
  • DEP enforcement: Enable Data Execution Prevention for all programs system-wide (bcdedit /set nx AlwaysOn or via System Properties → Performance → DEP) to raise the bar for shellcode execution following the NULL-byte overwrite.

Runbook · Step 3

Detection rules

  • Web proxy logs: Alert on requests for .mov or .qt files originating from affected legacy systems; SPL snippet: index=proxy src_ip IN (<affected_IPs>) uri_path="*.mov" OR uri_path="*.qt" | stats count by src_ip, uri_path
  • Sysmon EID 1 (Process Create): Flag child processes cmd.exe or wscript.exe spawned by iexplore.exe or wmplayer.exe — a strong indicator of post-exploitation after media file parsing; Sigma shape: ParentImage|endswith: 'iexplore.exe' + Image|endswith: 'cmd.exe'
  • Sysmon EID 7 (Image Load): Alert when quartz.dll is loaded by unexpected processes (browser plugins, Office applications) on legacy endpoints.
  • Network telemetry (Zeek/Suricata): Correlate outbound connections from affected endpoints to unknown external IPs within 60 seconds of an HTTP GET for a QuickTime media file — potential C2 beacon following successful exploitation.
  • Auditd (Linux proxy/gateway): If QuickTime files are cached on a Linux-based proxy, add an auditd rule on open syscalls for files matching the QuickTime MOOV magic bytes (0x6D6F6F76) and log the originating source IP.

Metrics

Severity
critical
Priority score
223.96
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
98.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
51.2 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-05-20 00:00 UTC
CWE
—

Affected operating systems

  • windows

    microsoft / windows_2000

  • windows

    microsoft / windows_2003_server

  • windows

    microsoft / windows_server_2003

  • windows

    microsoft / windows_xp

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • microsoft

    directx

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2009-1537