DirectX CVE-2009-1537: 2009 QuickTime Parser Bug in KEV

What to do

1. Inventory any Windows 2000, XP or Server 2003 machines, including embedded and vendor-managed systems.
2. Replace them, or isolate them on a segment with no internet access and no email or web use.
3. On any that must remain, confirm MS09-028 (KB971633) is installed.
4. If patching is impossible, apply Microsoft's workaround of removing the QuickTime parser registration (CLSID {D51BD5A0-7548-11CF-A520-0080C77EF58A}).

How to check if you are affected or compromised

• Query Active Directory or your asset inventory for operating systems matching XP, 2003 or 2000.
• On legacy hosts, run wmic qfe get hotfixid | findstr 971633 to confirm the patch.
• Treat any 2000, XP or 2003 host that has browsed the web or opened outside media files, and was never rebuilt, as untrusted.

What happened#

On May 28, 2009, Microsoft published Security Advisory 971778 about a publicly reported flaw in DirectShow, the media framework inside DirectX. The bug, CVE-2009-1537, sits in the QuickTime Movie Parser filter in quartz.dll. A crafted QuickTime file triggers a NULL byte overwrite and can run code as the logged-on user. The CVE record notes it was "exploited in the wild in May 2009." On July 14, 2009, Microsoft fixed it in MS09-028, rated Critical, along with two other DirectShow bugs, CVE-2009-1538 and CVE-2009-1539. The bulletin says Microsoft "had received information that this vulnerability was being exploited." It credits Thomas Garnier of SkyRecon and three researchers from Qihoo 360.

The attack needs a user to open a crafted file or load crafted content from a website, email or any app that renders web content. The bulletin adds that just hovering over such a file in a folder or share can crash the Windows shell.

Seventeen years later, on May 20, 2026, CISA added the CVE to its KEV catalog, with a June 3 deadline. CISA's enrichment scores it CVSS 3.1 8.8. It arrived in a batch with other 2008 to 2010 bugs, including CVE-2008-4250 (the Server service flaw behind MS08-067), CVE-2009-3459 in Adobe Reader, and two Internet Explorer flaws, plus two new Microsoft Defender bugs.

Who is affected#

Only Windows 2000 SP4, Windows XP SP2 and SP3, XP Professional x64, and Windows Server 2003 SP2, with DirectX 7.0, 8.1 or 9.0. Microsoft lists Vista and Server 2008 as not affected. It says the QuickTime parser "has been removed from Windows Vista and later operating systems." Windows XP left extended support in April 2014, and Server 2003 followed in July 2015.

Do you really need to act?#

Almost certainly not. Modern Windows does not contain the vulnerable code. No public source explains the 2026 listing. Security Affairs cites no campaign for the batch. We found no new exploitation report as of Oct 23, 2026. The listing may document the 2009 attacks, but CISA has not said.

The exception is the legacy machine nobody owns: an XP workstation running lab equipment, a Server 2003 box behind a production line, a kiosk. Such a system is exposed to far more than this one bug. Opening a media file or browsing on it is risky. If you have one, the fix is isolation or replacement.

What to do now#

1. Inventory legacy Windows. For example: Get-ADComputer -Filter 'OperatingSystem -like "*XP*" -or OperatingSystem -like "*2003*" -or OperatingSystem -like "*2000*"' -Properties OperatingSystem.
2. Replace these systems. Where that is not yet possible, isolate them with no internet, email or general web access.
3. Confirm MS09-028 is present with wmic qfe get hotfixid | findstr 971633.
4. If a system cannot be patched, Microsoft's workaround is to delete the registry key HKEY_CLASSES_ROOT\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A} (and its Wow6432Node twin on 64-bit). Back it up first. This disables QuickTime parsing in DirectShow.

How to tell if you were hit#

There is no specific indicator for this 2009 bug. On any surviving legacy host, review what users do on it. Look for media files from outside sources, browser use, and unexpected processes or autoruns. A machine that has run unpatched XP for years and touched the internet should be treated as untrusted and rebuilt or retired.

Timeline#

• May 28, 2009 — Microsoft publishes Advisory 971778 on the publicly reported flaw. The CVE record notes in-the-wild exploitation that month.
• Jul 14, 2009 — MS09-028 fixes the flaw.
• May 20, 2026 — CISA adds CVE-2009-1537 to KEV.
• Jun 3, 2026 — Federal remediation deadline.

Vulnerability records

• CVE-2009-1537 · KEV 2026-05-20 · Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft — Security Bulletin MS09-028: Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution (971633) learn.microsoft.com
2. Microsoft — Security Advisory 971778: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution learn.microsoft.com
3. CVE record — CVE-2009-1537 cve.org
4. CISA — Known Exploited Vulnerabilities: CVE-2009-1537 cisa.gov
5. Microsoft — Lifecycle: Windows XP learn.microsoft.com
6. Microsoft — Lifecycle: Windows Server 2003 learn.microsoft.com

Coverage and analysis

1. Security Affairs — U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com