CVE-2009-1537

CVE-2009-1537 is a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter inside quartz.dll, a DirectShow component of Microsoft DirectX. It is triggered when the affected DirectShow component parses a crafted QuickTime (.mov) media file, such as one opened from a website, media player, or email. A successful exploit allows a remote attacker to execute arbitrary code on the targeted system. Any Microsoft installation with the vulnerable DirectX/DirectShow component is affected, with real-world risk concentrated on systems that render untrusted QuickTime media. The flaw is long-standing (2009) but CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-20, confirming active exploitation; EPSS puts its 30-day exploitation probability at 51.2% (99th percentile), while no public PoC is known and ransomware use is unconfirmed.

What to do: Apply Microsoft's mitigations per vendor instructions, and follow BOD 22-01 requirements for cloud services in federal environments; ensure affected systems have the vendor's updated quartz.dll/DirectShow fix installed rather than relying on default installations. Until patched, avoid opening untrusted QuickTime (.mov) files and block or inspect .mov files delivered via email and web downloads. Treat this as a high priority given the KEV listing and elevated EPSS score, even though ransomware association is not yet confirmed.