CVE-2009-1537
Microsoft Directx 7.0 … 9.0c
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2009-1537 is a high-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Microsoft Directx. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an unspecified issue, also known as the DirectX NULL Byte Overwrite Vulnerability, in the QuickTime Movie Parser Filter in quartz.dll within DirectShow as part of Microsoft DirectX 7.0 through 9.0c. Affected platforms include Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2.
Remote attackers can exploit the flaw by supplying a crafted QuickTime media file, which may result in arbitrary code execution. The vulnerability was exploited in the wild in May 2009.
Microsoft Security Advisory 971778 addresses the DirectShow vulnerability, with further technical analysis available from the Microsoft Security Response Center and Security Research and Defense blogs. Additional references from SANS ISC, OSVDB, and Secunia document the issue and its exploitation characteristics.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2009-1533
Vulnerability Data
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via…
more
a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
- CWE(s)
- KEV Date Added
- 20 May 2026
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach improper neutralization of null bytes, but leaves a bounded remainder (e.g. incomplete enforcement across all languages, libraries, or outsourced code where assurance is only obtained).
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
A.8.27 mandates security-by-design principles, secure coding practices (including data validation/sanitization), design reviews against attack patterns, and hardening; these reach some but not most instances of improper NUL neutralization (a specific input-handling flaw in downstream components).
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.
Security testing can detect null-byte flaws but does not itself implement the neutralization.