---
title: "DirectX CVE-2009-1537: 2009 QuickTime Parser Bug in KEV"
url: https://erroneo.us/security/briefs/directx-quicktime-parser-cve-2009-1537-kev/
description: "A 2009 DirectShow QuickTime parsing zero-day (MS09-028) on Windows 2000, XP and Server 2003 joined CISA KEV in May 2026. Vista and later are not affected."
type: security-brief
section: "Security Digest"
date_published: 2009-05-28
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2009-1537"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# DirectX CVE-2009-1537: 2009 QuickTime Parser Bug in KEV

**Verdict: Most can relax.** Only Windows 2000, XP and Server 2003 have the vulnerable QuickTime parser, it was patched in July 2009, and those systems have been unsupported for over a decade; find and isolate any that remain rather than worrying about this CVE.

- **Who must act:** Anyone still running Windows XP, Windows Server 2003 or Windows 2000, typically in industrial, medical, lab or kiosk systems, especially if users open media files or browse the web on them.
- **Who can relax:** Everyone on Windows Vista, Server 2008 or any later release; Microsoft lists them as not affected, and the vulnerable component is not present.
- **Affected:** DirectX 7.0, 8.1 and 9.0 (9.0a/b/c) on Windows 2000 SP4; DirectX 9.0 on Windows XP SP2 and SP3, and XP Professional x64 SP2; DirectX 9.0 on Windows Server 2003 SP2 (x86, x64 and Itanium)
- **Fixed:** MS09-028 (KB971633), July 14, 2009; Windows Vista, Server 2008 and later are not affected
- **CVEs:** CVE-2009-1537
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory any Windows 2000, XP or Server 2003 machines, including embedded and vendor-managed systems.
2. Replace them, or isolate them on a segment with no internet access and no email or web use.
3. On any that must remain, confirm MS09-028 (KB971633) is installed.
4. If patching is impossible, apply Microsoft's workaround of removing the QuickTime parser registration (CLSID {D51BD5A0-7548-11CF-A520-0080C77EF58A}).

### How to check if you are affected

- Query Active Directory or your asset inventory for operating systems matching XP, 2003 or 2000.
- On legacy hosts, run wmic qfe get hotfixid | findstr 971633 to confirm the patch.
- Treat any 2000, XP or 2003 host that has browsed the web or opened outside media files, and was never rebuilt, as untrusted.

## What happened

On May 28, 2009, Microsoft published [Security Advisory 971778](https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/971778) about a publicly reported flaw in DirectShow, the media framework inside DirectX. The bug, CVE-2009-1537, sits in the QuickTime Movie Parser filter in `quartz.dll`. A crafted QuickTime file triggers a NULL byte overwrite and can run code as the logged-on user. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2009-1537) notes it was "exploited in the wild in May 2009." On July 14, 2009, Microsoft fixed it in [MS09-028](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028), rated Critical, along with two other DirectShow bugs, CVE-2009-1538 and CVE-2009-1539. The bulletin says Microsoft "had received information that this vulnerability was being exploited." It credits Thomas Garnier of SkyRecon and three researchers from Qihoo 360.

The attack needs a user to open a crafted file or load crafted content from a website, email or any app that renders web content. The bulletin adds that just hovering over such a file in a folder or share can crash the Windows shell.

Seventeen years later, on May 20, 2026, CISA added the CVE to its [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537), with a June 3 deadline. CISA's enrichment scores it CVSS 3.1 8.8. It arrived in a batch with other 2008 to 2010 bugs, including CVE-2008-4250 (the Server service flaw behind MS08-067), CVE-2009-3459 in Adobe Reader, and two Internet Explorer flaws, plus two new Microsoft Defender bugs.

## Who is affected

Only Windows 2000 SP4, Windows XP SP2 and SP3, XP Professional x64, and Windows Server 2003 SP2, with DirectX 7.0, 8.1 or 9.0. Microsoft lists Vista and Server 2008 as not affected. It says the QuickTime parser "has been removed from Windows Vista and later operating systems." Windows XP left [extended support](https://learn.microsoft.com/en-us/lifecycle/products/windows-xp) in April 2014, and Server 2003 [followed](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2003-) in July 2015.

## Do you really need to act?

Almost certainly not. Modern Windows does not contain the vulnerable code. No public source explains the 2026 listing. [Security Affairs](https://securityaffairs.com/192508/security/u-s-cisa-adds-microsoft-and-adobe-flaws-to-its-known-exploited-vulnerabilities-catalog.html) cites no campaign for the batch. We found no new exploitation report as of Oct 23, 2026. The listing may document the 2009 attacks, but CISA has not said.

The exception is the legacy machine nobody owns: an XP workstation running lab equipment, a Server 2003 box behind a production line, a kiosk. Such a system is exposed to far more than this one bug. Opening a media file or browsing on it is risky. If you have one, the fix is isolation or replacement.

## What to do now

1. Inventory legacy Windows. For example: `Get-ADComputer -Filter 'OperatingSystem -like "*XP*" -or OperatingSystem -like "*2003*" -or OperatingSystem -like "*2000*"' -Properties OperatingSystem`.
2. Replace these systems. Where that is not yet possible, isolate them with no internet, email or general web access.
3. Confirm MS09-028 is present with `wmic qfe get hotfixid | findstr 971633`.
4. If a system cannot be patched, Microsoft's workaround is to delete the registry key `HKEY_CLASSES_ROOT\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}` (and its `Wow6432Node` twin on 64-bit). Back it up first. This disables QuickTime parsing in DirectShow.

## How to tell if you were hit

There is no specific indicator for this 2009 bug. On any surviving legacy host, review what users do on it. Look for media files from outside sources, browser use, and unexpected processes or autoruns. A machine that has run unpatched XP for years and touched the internet should be treated as untrusted and rebuilt or retired.

## Timeline

- May 28, 2009 — Microsoft publishes Advisory 971778 on the publicly reported flaw. The CVE record notes in-the-wild exploitation that month.
- Jul 14, 2009 — MS09-028 fixes the flaw.
- May 20, 2026 — CISA adds CVE-2009-1537 to KEV.
- Jun 3, 2026 — Federal remediation deadline.

## Sources

1. [Microsoft — Security Bulletin MS09-028: Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution (971633)](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028)
2. [Microsoft — Security Advisory 971778: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution](https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/971778)
3. [CVE record — CVE-2009-1537](https://www.cve.org/CVERecord?id=CVE-2009-1537)
4. [CISA — Known Exploited Vulnerabilities: CVE-2009-1537](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537)
5. [Microsoft — Lifecycle: Windows XP](https://learn.microsoft.com/en-us/lifecycle/products/windows-xp)
6. [Microsoft — Lifecycle: Windows Server 2003](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2003-)
7. [Security Affairs — U.S. CISA adds Microsoft and Adobe flaws to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/192508/security/u-s-cisa-adds-microsoft-and-adobe-flaws-to-its-known-exploited-vulnerabilities-catalog.html)

---
Source page: https://erroneo.us/security/briefs/directx-quicktime-parser-cve-2009-1537-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt