CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability

EPSS trend

Probability

51.36%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+0.15 pp

From 51.21% on 20-09-2026

20-09-202620-10-2026

EPSS score

51.36%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 20-05-2026
Federal due date: 03-06-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 nvd.nist.gov/vuln/detail/CVE-2009-1537

Public exploits

0 found

No public exploits indexed.

References

14 links

docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028Vendor AdvisoryX Refsource MS
blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspxX Refsource CONFIRMVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237VDB EntrySignatureX Refsource OVALBroken Link
secunia.com/advisories/35268Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1022299VDB EntryX Refsource SECTRACKBroken Link
www.vupen.com/english/advisories/2009/1886VDB EntryX Refsource VUPENVendor Advisory
www.vupen.com/english/advisories/2009/1445VDB EntryX Refsource VUPENVendor Advisory
osvdb.org/54797VDB EntryX Refsource OSVDBBroken Link
www.securityfocus.com/bid/35139VDB EntryX Refsource BIDBroken Link
www.us-cert.gov/cas/techalerts/TA09-195A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource

Show all 14 references

isc.sans.org/diary.html?storyid=6481X Refsource MISCNot Applicable
www.microsoft.com/technet/security/advisory/971778.mspxX Refsource CONFIRMPatchVendor Advisory
blogs.technet.com/msrc/…X Refsource CONFIRMVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537Government ResourceUS Government Resource

Related vulnerabilities

CVE-2003-0346microsoftdirectx32.67%23y ago25-07-2003 04:00Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow.CVE-2013-1263microsoftwindows_xp1.47%13y ago13-02-2013 11:00Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.CVE-2013-1252microsoftwindows_xp1.47%13y ago13-02-2013 11:00Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.CVE-2013-1269microsoftwindows_xp1.52%13y ago13-02-2013 11:00Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.CVE-2013-1286microsoftwindows_7+51.46%13y ago13-03-2013 00:00The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1285 and CVE-2013-1287.CVE-2013-1275microsoftwindows_xp1.05%13y ago13-02-2013 11:00Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.

All vulnerabilities indirectx windows_xp

CVE-2009-1537: Microsoft DirectX NULL Byte Overwrite Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References