CVE-2009-1537
Microsoft Directx 7.0 … 9.0c
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2009-1537 is a high-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Microsoft Directx. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an unspecified issue, also known as the DirectX NULL Byte Overwrite Vulnerability, in the QuickTime Movie Parser Filter in quartz.dll within DirectShow as part of Microsoft DirectX 7.0 through 9.0c. Affected platforms include Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2.
Remote attackers can exploit the flaw by supplying a crafted QuickTime media file, which may result in arbitrary code execution. The vulnerability was exploited in the wild in May 2009.
Microsoft Security Advisory 971778 addresses the DirectShow vulnerability, with further technical analysis available from the Microsoft Security Response Center and Security Research and Defense blogs. Additional references from SANS ISC, OSVDB, and Secunia document the issue and its exploitation characteristics.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2009-1533
Vulnerability Data
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via…
more
a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
- CWE(s)
- KEV Date Added
- 20 May 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.