{"id":"windows-directx-quicktime-exploited-may-2026","category":"patch","status":"closed","title":"Old Microsoft DirectX flaw CVE-2009-1537 added to CISA’s exploited list; fixed since 2009","tldr":"CISA listed an exploited DirectX flaw affecting old Windows 2000, XP and Server 2003 systems. Malicious QuickTime files can run code. Microsoft fixed it in 2009; have a technician check legacy computers for MS09-028 and move them to supported Windows.","summary":"CVE-2009-1537 affects the Windows component that reads QuickTime movie files, allowing malicious files to run code with the victim’s permissions. Microsoft documented limited attacks in 2009 and released a fix that July. Its affected list covers DirectX on Windows 2000, Windows XP and Windows Server 2003; Windows Vista and Windows Server 2008 were explicitly unaffected. On 20 May 2026, CISA added the flaw to its exploited-vulnerabilities catalogue. That confirms known exploitation, but the announcement does not establish when any recent attacks occurred, who was targeted or how widespread they were. As at 3 November 2026, the sources reviewed identify no later campaign details or replacement fix. The existing MS09-028 update remains the documented remedy.","action":"If you still have a Windows 2000 or Windows XP computer, ask a trusted technician to check for security update KB971633 (MS09-028) and move it to a supported Windows version. Ask your IT provider to check any Windows Server 2003 systems too.","product":"Microsoft DirectX / DirectShow on Windows 2000, XP and Server 2003","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2009-1537"],"tags":["microsoft","windows","directx","directshow","code-execution","known-exploited"],"affected":["Windows 2000 Service Pack 4 with DirectX 7.0, 8.1, 8.1b, 9.0, 9.0a, 9.0b or 9.0c","Windows XP Service Pack 2 or Service Pack 3 with DirectX 9.0, 9.0a, 9.0b or 9.0c","Windows XP Professional x64 Edition Service Pack 2 with DirectX 9.0, 9.0a, 9.0b or 9.0c","Windows Server 2003 Service Pack 2, including x64 and Itanium editions, with DirectX 9.0, 9.0a, 9.0b or 9.0c"],"fixed":["MS09-028 / KB971633: platform-specific security updates released 14 July 2009"],"matches":[{"platform":"windows","app":"Microsoft DirectX (Windows 2000 and Windows XP)","bundle":"","fixed":"KB971633 (MS09-028)"}],"sources":[{"kind":"advisory","title":"Microsoft Security Bulletin MS09-028 — Vulnerabilities in Microsoft DirectShow","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028","by":"Microsoft","date":"2009-08-19"},{"kind":"advisory","title":"Microsoft Security Advisory 971778","url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/971778","by":"Microsoft","date":"2009-07-14"},{"kind":"research","title":"Exploit:Win32/CVE-2009-1537 threat description","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit%3AWin32%2FCVE-2009-1537","by":"Microsoft","date":"2017-09-15"},{"kind":"advisory","title":"CISA Adds Seven Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4182ffb","by":"CISA","date":"2026-05-20"},{"kind":"advisory","title":"CVE-2009-1537 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2009-1537","by":"NIST","date":"2026-06-16"}],"started":"2026-05-20","closed":"2026-05-20","created":"2026-11-03T22:20:49.946Z","updated":"2026-11-03T22:20:49.946Z","cve_notes":[{"cve":"CVE-2009-1537","name":"Code execution in DirectShow’s QuickTime file reader","what":"A null-byte overwrite in DirectShow’s QuickTime Movie Parser Filter in quartz.dll lets a malicious movie file run code with the user’s permissions.","severity":"critical","cvss":0}],"timeline":[{"at":"2026-05-20","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2009-1537 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. Its announcement did not identify victims or a particular campaign.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4182ffb","by":"CISA","patch":null},{"at":"2009-08-19","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Microsoft clarified that its DirectX 8.1 update also covered DirectX 8.1b.","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028","by":"Microsoft","patch":null},{"at":"2009-07-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft released MS09-028, fixing CVE-2009-1537 across the affected Windows editions it supported at the time.","url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/971778","by":"Microsoft","patch":"patched"},{"at":"2009-06-03","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Microsoft published a threat report describing limited active attacks using malicious QuickTime files, which could download further malware.","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit%3AWin32%2FCVE-2009-1537","by":"Microsoft","patch":null},{"at":"2009-05-28","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Microsoft published advisory 971778 about a code-execution flaw in DirectShow, later identified as CVE-2009-1537.","url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/971778","by":"Microsoft","patch":"none"}],"url":"https://hard.fyi/live/windows-directx-quicktime-exploited-may-2026/","json":"https://hard.fyi/api/live?id=windows-directx-quicktime-exploited-may-2026"}