Is CVE-2009-1537 being actively exploited?

Yes. CVE-2009-1537 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 20, 2026.

What is the CVSS score for CVE-2009-1537?

CVE-2009-1537 has a CVSS 3.1 base score of 8.8 (HIGH).

CVE-2009-1537

HIGH · CVSS 8.8CISA KEV: actively exploitedEPSS 51.1%EU EUVD: exploited

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."

Key facts

CVSS score: 8.8 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-158
EPSS score: 51.1% (99th percentile)
In CISA KEV: Yes, added May 20, 2026
In EU EUVD: Yes (EUVD-2009-1533)
Published: May 29, 2009
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Microsoft DirectX NULL Byte Overwrite Vulnerability

Added to the KEV catalog on May 20, 2026; federal remediation due June 3, 2026.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1533 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on May 21, 2026.

View on the EU Vulnerability Database

Affected products

microsoft / directx
microsoft / directx
microsoft / directx
microsoft / directx
microsoft / directx
microsoft / directx
microsoft / directx
microsoft / directx
microsoft / directx
microsoft / windows 2000
microsoft / windows 2003 server
microsoft / windows 2003 server
microsoft / windows 2003 server
microsoft / windows server 2003
microsoft / windows xp
microsoft / windows xp
microsoft / windows xp

References

http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx(Vendor Advisory)
http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx(Vendor Advisory)
http://isc.sans.org/diary.html?storyid=6481(Not Applicable)
http://osvdb.org/54797(Broken Link)
http://secunia.com/advisories/35268(Vendor Advisory)
http://www.microsoft.com/technet/security/advisory/971778.mspx(Patch, Vendor Advisory)
http://www.securityfocus.com/bid/35139(Broken Link)
http://www.securitytracker.com/id?1022299(Broken Link)
http://www.us-cert.gov/cas/techalerts/TA09-195A.html(US Government Resource)
http://www.vupen.com/english/advisories/2009/1445(Vendor Advisory)
http://www.vupen.com/english/advisories/2009/1886(Vendor Advisory)
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028(Vendor Advisory)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237(Broken Link)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain