Yes. CISA added CVE-2009-1537 to its Known Exploited Vulnerabilities catalogue on 20 May 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
What the KEV listing means for this CVE
CISA’s KEV catalogue is the most practical indicator here: once a CVE appears in that list, defenders should treat it as an active exploitation problem, not just a theoretical weakness. For this case, the question is not whether the flaw exists, but whether any asset still exposes the vulnerable DirectX/DirectShow path and can be reached by a crafted media file.
The immediate verification step is to confirm whether the affected DirectX components are present on any supported or long-lived system, and whether those systems can process untrusted QuickTime content. CISA Known Exploited Vulnerabilities Catalog and the vendor advisory should be used together to confirm the exact remediation path and any compensating controls.
For prioritisation, this kind of issue belongs with the broader class of Zero-Day and Exploited Vulnerabilities Guide problems: active exploitation changes urgency, testing order, and exception handling. It is also a reminder that media parsing bugs often become execution bugs when they sit in widely reachable client-side components.
How exploitation usually happens in practice
The vulnerable condition is a NULL byte overwrite in a media parser, so the attacker does not need to win through credentials or social engineering alone. The usual pattern is delivery of a crafted file that reaches a parser through an application or embedded component, then memory corruption is triggered as the media content is opened or previewed.
That makes exposure broader than a single application install. Any system or workflow that can ingest user-supplied media, preview attachments, or auto-process rich content may inherit the risk if it still relies on the affected DirectShow path. The Web Application Attacks Guide is relevant here because the same exploit logic applies whenever attacker-controlled content is parsed by a trusted component.
Administrators should also avoid assuming that “old” means “inactive”. Older parser bugs are often exploited opportunistically when legacy systems, archived file shares, or compatibility components remain reachable. If the affected code path exists, the exploitability question becomes one of reachability and exposure, not software age alone.
What to do if patching or removal is delayed
If immediate remediation is not possible, reduce the number of systems that can accept or preview untrusted QuickTime media, and restrict where those files can be opened. That means tightening file handling paths, disabling unnecessary previews, and isolating systems that must continue processing legacy media formats.
Vulnerability Management Guide is useful for the operational side of this decision because delay is only acceptable when it is tracked as an exception with a clear SLA, a compensating control, and an owner. For exploited vulnerabilities, “we plan to patch later” is not a control unless the exposure is measurably reduced in the meantime.
Compensating controls should focus on limiting file intake, constraining where parsing happens, and monitoring for anomalous crashes or unexpected child-process activity around media handling. If the system cannot be patched promptly, the safer choice is often to remove the exposed feature path entirely until the fix is in place.
Risk and Threat Considerations
This vulnerability matters because active exploitation turns a parser bug into a likely entry point for remote code execution. Once a crafted media file can trigger arbitrary code, the impact depends on the privileges of the process that opens it and the trust placed in downstream file content.
Failure mechanism: A malformed media object reaches the vulnerable DirectShow parsing path, the NULL byte overwrite corrupts memory, and the attacker gains execution in a context that may have access to user data, local resources, or adjacent trust relationships.
Impact: Successful exploitation can lead to code execution, device compromise, persistence, or follow-on lateral movement if the affected system has broad network reach or elevated local access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Network and Environment Monitoring | Actively exploited CVEs require monitoring for suspicious crashes and exploitation signals. |
| RS.MI-03 — Mitigation | A KEV-listed vulnerability needs prompt containment and remediation actions. | |
| Recommendation — Monitor exposed systems for exploitation indicators and abnormal parser activity. Contain exposure quickly and remediate the vulnerable component or code path. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The issue is a known exploited vulnerability that needs prioritised discovery and remediation. |
| CIS-8 — Audit Log Management | Exploit validation and post-exploitation checks depend on usable logs and telemetry. | |
| Recommendation — Identify exposed assets and prioritise this CVE for immediate remediation. Retain and review logs around media handling, crashes, and suspicious execution. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Known exploited flaws require prompt remediation and exception handling. |
| Recommendation — Apply the fix or approved mitigation as soon as possible. | ||
Practitioner Guidance
What to verify: Confirm where the affected DirectX/DirectShow components still exist, which systems can ingest untrusted QuickTime content, and whether those systems are internet-facing, externally exposed, or used for attachment handling. If you cannot quickly answer those three questions, you do not yet have sufficient exposure visibility.
Decision rule: If the vulnerable component is reachable and remediation is available, patch or remove the path first, then hunt for compromise. If patching must wait, treat media intake restriction and feature isolation as the minimum acceptable short-term action.
Practitioner takeaway: KEV inclusion means this is an exploitation response problem, not a catalogue lookup problem, so priority should go to exposure confirmation, rapid remediation, and compromise assessment rather than extended debate about theoretical severity.
Related resources from NHI Mgmt Group
- CVE-2009-1537 (Microsoft DirectX NULL Byte Overwrite)
- Is CVE-2023-32049 (Microsoft Windows Defender SmartScreen Security Feature Bypass) being exploited in the wild?
- Is CVE-2017-8540 (Microsoft Malware Protection Engine Improper Restriction of Operations) being exploited in the wild?
- Is CVE-2021-1647 (Microsoft Defender Remote Code Execution) being exploited in the wild?