NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Old Microsoft DirectX flaw CVE-2009-1537 added to CISA’s exploited list; fixed since 2009

CISA listed an exploited DirectX flaw affecting old Windows 2000, XP and Server 2003 systems. Malicious QuickTime files can run code. Microsoft fixed it in 2009; have a technician check legacy computers for MS09-028 and move them to supported Windows.

What to do

If you still have a Windows 2000 or Windows XP computer, ask a trusted technician to check for security update KB971633 (MS09-028) and move it to a supported Windows version. Ask your IT provider to check any Windows Server 2003 systems too.

Check your devices
  • Microsoft DirectX (Windows 2000 and Windows XP)fixed in KB971633 (MS09-028) and later

What’s happening

CVE-2009-1537 affects the Windows component that reads QuickTime movie files, allowing malicious files to run code with the victim’s permissions. Microsoft documented limited attacks in 2009 and released a fix that July. Its affected list covers DirectX on Windows 2000, Windows XP and Windows Server 2003; Windows Vista and Windows Server 2008 were explicitly unaffected. On 20 May 2026, CISA added the flaw to its exploited-vulnerabilities catalogue. That confirms known exploitation, but the announcement does not establish when any recent attacks occurred, who was targeted or how widespread they were. As at 3 November 2026, the sources reviewed identify no later campaign details or replacement fix. The existing MS09-028 update remains the documented remedy.

What
Flaw
Affects
Microsoft DirectX / DirectShow on Windows 2000, XP and Server 2003
Affected
Windows 2000 Service Pack 4 with DirectX 7.0, 8.1, 8.1b, 9.0, 9.0a, 9.0b or 9.0c
Windows XP Service Pack 2 or Service Pack 3 with DirectX 9.0, 9.0a, 9.0b or 9.0c
Windows XP Professional x64 Edition Service Pack 2 with DirectX 9.0, 9.0a, 9.0b or 9.0c
Windows Server 2003 Service Pack 2, including x64 and Itanium editions, with DirectX 9.0, 9.0a, 9.0b or 9.0c
Fixed in
MS09-028 / KB971633: platform-specific security updates released 14 July 2009
CVE
CVE-2009-1537
Since
20 May 2026
Closed
20 May 2026

Timeline

  1. CISA added

    CISA added CVE-2009-1537 to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation. Its announcement did not identify victims or a particular campaign.

  2. Vendor revised

    Microsoft clarified that its DirectX 8.1 update also covered DirectX 8.1b.

  3. New fixFixed

    Microsoft released MS09-028, fixing CVE-2009-1537 across the affected Windows editions it supported at the time.

  4. Update

    Microsoft published a threat report describing limited active attacks using malicious QuickTime files, which could download further malware.

  5. Made publicNo fix yet

    Microsoft published advisory 971778 about a code-execution flaw in DirectShow, later identified as CVE-2009-1537.

Sources

  1. Microsoft Security Bulletin MS09-028 — Vulnerabilities in Microsoft DirectShowMicrosoft · 19 Aug 2009
  2. Microsoft Security Advisory 971778Microsoft · 14 July 2009
  3. Exploit:Win32/CVE-2009-1537 threat descriptionMicrosoft · 15 Sept 2017
  4. CISA Adds Seven Known Exploited Vulnerabilities to CatalogCISA · 20 May 2026
  5. CVE-2009-1537 DetailNIST · 16 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS