[KEV] CVE-2009-1537 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2009-1537 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2009-1537 is a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter component within quartz.dll, part of Microsoft DirectShow in Microsoft DirectX, which can be triggered by a remote attacker through a maliciously crafted QuickTime media file.

Technical Detail

The flaw resides in how the QuickTime Movie Parser Filter in quartz.dll processes QuickTime media files, where improper handling of input data results in a NULL byte overwrite condition in memory. An attacker can exploit this by delivering a specially crafted QuickTime file to a target system, for example through a malicious web page or email attachment, causing the vulnerable parser to corrupt memory in a controlled manner. Successful exploitation results in remote code execution (RCE) in the context of the user running the affected application, potentially allowing full system compromise if the user has elevated privileges.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities (KEV) catalog on May 20, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and has been demonstrated in real-world attack scenarios, not merely as a proof of concept. Organizations should treat this as an actively weaponized vulnerability requiring immediate remediation.

Who Is Targeting This

No specific threat actor attribution is confirmed at this time. No campaigns, targeted sectors, or named threat groups are associated with this CVE in current intelligence reporting. Given the age of the vulnerability and its recent KEV listing, it is possible this is being leveraged opportunistically against unpatched legacy systems.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog listing dated May 20, 2026, organizations subject to BOD 22-01 must apply available mitigations or patches by the CISA-specified remediation deadline. Microsoft addressed this vulnerability through security updates released in 2009; any system still running an unpatched version of Microsoft DirectX with the affected quartz.dll should be patched immediately. Where patching is not immediately possible, restricting the parsing of QuickTime media files and blocking delivery of .mov and related QuickTime file types at the network perimeter and email gateway can reduce exposure. Detection efforts should focus on monitoring for anomalous process execution originating from media player or DirectShow-related processes, as well as unexpected network connections following media file access.