CVE-2009-1537: Microsoft DirectX -- MPEG2 Null Byte Overwrite via quartz.dll

Background

Microsoft DirectX is the foundational multimedia framework built into Windows, providing APIs for rendering graphics, processing audio, and parsing video and audio media files. A core component of DirectX’s media handling is quartz.dll — the DirectShow filter graph manager and the engine responsible for parsing and rendering a wide range of media formats including MPEG-1, MPEG-2, AVI, and Windows Media files. Because DirectShow is tightly integrated into Windows Explorer, Internet Explorer, Windows Media Player, and any application that uses the DirectShow API, a vulnerability in quartz.dll is automatically reachable through a broad array of user-facing attack surfaces.

CVE-2009-1537 is a memory corruption vulnerability in quartz.dll’s MPEG2 stream parser. When the parser processes a specially crafted MPEG2 media file, a flaw in its handling of certain stream structure data results in a null byte overwrite of heap memory. This type of vulnerability, while less immediately obvious than a classic stack overflow, can be leveraged by an attacker to achieve reliable code execution by carefully positioning heap objects so that the null byte overwrite corrupts a critical structure at a known offset.

This vulnerability was significant in 2009 not only for its technical severity but for the attack vectors it exposed. Malicious .mpg or .mpeg files embedded in web pages or delivered as email attachments would trigger the vulnerability automatically upon preview or playback, without any user confirmation dialog beyond opening the file. Internet Explorer and Windows Explorer’s preview pane would both trigger the vulnerable parsing path.

CISA added CVE-2009-1537 to the Known Exploited Vulnerabilities catalog in May 2026 because active exploitation continues against legacy Windows environments. Systems running Windows XP, Vista, or Server 2003/2008 without the MS09-028 patch remain vulnerable, and these systems persist in industrial, healthcare, and government environments where OS modernization has been deferred.

Technical Mechanism

The vulnerability exists in the MPEG2 stream packet parsing code within quartz.dll. MPEG2 streams are structured as a sequence of packets with headers that specify packet type, length, and stream identification. The quartz.dll parser reads these headers and uses the length and type fields to guide processing of packet payloads.

The flaw is a null byte overwrite condition: when processing certain MPEG2 packet structures, the parser performs an arithmetic or indexing operation using attacker-controlled data that results in writing a single null byte (0x00) to an incorrect memory location. While a single-byte write may appear benign, in the context of a heap-based exploit the consequences are significant:

• Heap metadata corruption: The null byte lands in the size or flag field of an adjacent heap chunk’s header, corrupting the heap allocator’s metadata. On Windows XP’s default heap implementation, this corruption can be exploited to gain write-what-where control through subsequent heap operations.
• Virtual function table corruption: If the null byte overwrites part of a pointer to a virtual function table (vtable) used by a COM object in the DirectShow filter graph, the attacker can redirect execution to controlled data when the vtable method is next called.

The exploit leverages heap spraying techniques — filling heap memory with shellcode disguised as innocuous data at predictable addresses — so that when execution is redirected, it lands reliably within attacker-controlled memory.

Attack flow:

1. Attacker crafts an MPEG2 file with malformed packet headers designed to trigger the null byte overwrite at a favorable heap offset
2. The file is delivered to a victim via email attachment, web page embed, or malicious download link
3. The victim’s system processes the file — automatically in many cases via Explorer preview, Internet Explorer inline media handling, or Windows Media Player
4. quartz.dll parses the MPEG2 stream and performs the corrupting null byte write
5. Subsequent heap or COM object operations trigger the corruption, redirecting execution to attacker-controlled shellcode in the heap spray region
6. Shellcode executes with the privileges of the process that opened the file (typically the logged-in user, or SYSTEM if triggered via a service)

Microsoft addressed this vulnerability in MS09-028, released June 2009. However, unpatched systems remain exploitable with publicly available exploit code more than 15 years later.

# CVE-2009-1537 -- Proof-of-concept structure for a malicious MPEG2 file
# The exploit crafts an MPEG2 pack header with a corrupted packet length field
# that causes quartz.dll to perform a null byte overwrite at a controlled heap offset.

# MPEG2 stream structure (simplified):
# Pack header (pack_start_code = 0x000001BA) followed by PES packet headers
# PES packet header: 0x000001 <stream_id> <PES_packet_length (2 bytes)>

# Malicious PES packet: length field set to trigger off-by-one or arithmetic wrap
# causing the parser to write 0x00 at heap_base + controlled_offset

# JavaScript heap spray (embedded in HTML that auto-loads the MPEG via <object> tag):
# <script>
#   var spray = unescape("%u9090%u9090");  // NOP sled
#   while (spray.length < 0x10000) spray += spray;
#   // Append shellcode (download+exec stub) to each sled chunk
#   var shellcode = unescape("<encoded_shellcode>");
#   var heap_blocks = [];
#   for (var i = 0; i < 1000; i++) {
#     heap_blocks[i] = spray.substring(0, 0x3ff8 - shellcode.length) + shellcode;
#   }
# </script>
# <object classid="clsid:E0D79300-84BE-11CE-9641-444553540000"
#         data="malicious.mpg"></object>

# The null byte overwrite corrupts adjacent heap metadata or a vtable pointer,
# and the subsequent COM method dispatch lands in the heap spray at ~0x0A0A0A0A.

Real-World Exploitation Evidence

At the time of disclosure in 2009, CVE-2009-1537 was reported as a zero-day being actively exploited in targeted attacks. The exploitation method — embedding malicious MPEG2 content in web pages or documents to trigger drive-by execution — was consistent with the techniques used by exploit kit operators of that era (MPack, Neosploit, and their successors).

The vulnerability was added to commercially available exploit kits within weeks of its disclosure, dramatically expanding the exploitation base from targeted attackers to a broad population of cybercriminals. Security researchers documented drive-by campaigns using CVE-2009-1537 as part of multi-stage malware delivery chains installing banking trojans and rootkits.

CISA’s 2026 KEV addition reflects continued exploitation targeting legacy systems. Threat actors conducting campaigns against industrial control system environments, air-gapped networks accessed via removable media, and legacy healthcare infrastructure have incorporated CVE-2009-1537 into their toolkits because the attack surface — Windows XP systems with DirectX — remains present in these environments. Delivery via USB-borne malicious media files is particularly relevant for air-gapped target environments.

Impact Assessment

• Arbitrary code execution — Successful exploitation grants the attacker code execution with the privileges of the vulnerable process, typically the interactive user. On Windows XP, where the default user is an administrator, this translates to full system compromise.
• No user interaction required beyond file access — On affected systems, merely opening a folder containing a malicious MPEG2 file in Windows Explorer (which triggers thumbnail/preview generation) is sufficient. No explicit “open” action by the user is needed.
• Broad attack surface — Any Windows application using DirectShow to process MPEG2 content is vulnerable, including Internet Explorer, Windows Media Player, Windows Explorer preview pane, and numerous third-party applications.
• Persistence and malware delivery — Exploitation in 2009-era campaigns typically led to installation of backdoors, rootkits, and banking trojans. In 2026 campaigns, the payload is more likely to be ransomware precursors or access-brokering malware.
• Air-gap penetration — USB delivery of malicious media files makes this vulnerability relevant for targeting air-gapped systems that cannot be reached over the network.

Affected Versions

Remediation Steps

1. Apply MS09-028 (KB971633) on any system running an affected and supportable Windows version. For Vista and Server 2008, this patch is available and must be applied.

:: Verify MS09-028 is installed
wmic qfe get HotFixID | findstr KB971633

:: If not present, apply the patch from Microsoft Update Catalog (KB971633)

2. Migrate from end-of-life platforms — Windows XP, Server 2003, and Windows 2000 are unsupported. Migrate to a supported Windows version. If migration is not immediately possible, implement compensating controls.
3. Disable DirectShow MPEG2 parsing — As a compensating control, the Windows Kill Bit mechanism can be used to disable specific DirectShow filters. Consult MS09-028 guidance for specific Kill Bit registry values that disable the vulnerable quartz.dll MPEG2 parsing path.

:: Set Kill Bit for the vulnerable quartz.dll MPEG2 filter (CLSID as documented in MS09-028)
:: This prevents DirectShow from instantiating the vulnerable COM object
reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f

:: On 64-bit systems, also set the Wow6432Node key:
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" /v "Compatibility Flags" /t REG_DWORD /d 0x00000400 /f

:: Disable thumbnail preview for video files in Windows Explorer (via Group Policy):
:: User Configuration > Administrative Templates > Windows Components > Windows Explorer
:: > "Turn off the display of thumbnails and only display icons" = Enabled

4. Restrict media file handling — Configure Group Policy to restrict execution and preview of MPEG2 files on systems that do not require media playback.
5. Email gateway filtering — Configure email security gateways to block .mpg, .mpeg, and .m2v file attachments.
6. Disable thumbnail preview — On Windows Explorer, disable thumbnail preview for media files in sensitive environments to prevent automatic parsing of files in monitored directories.
7. Network isolation — For legacy systems that cannot be patched, isolate them on network segments without internet access and with strict controls on file transfer from external sources.

Detection Guidance

Detection for CVE-2009-1537 exploitation:

• Process crash events in iexplore.exe, wmplayer.exe, explorer.exe, or other media-handling processes, particularly with access violation exit codes (0xC0000005), correlated with recent media file access
• Application Event Log entries from Windows Error Reporting (WER) referencing quartz.dll in crash reports
• Unexpected child process creation from media-handling processes following opening of .mpg or .mpeg files
• EDR/AV alerts for shellcode patterns or heap spray activity in processes handling media files
• Network connections from media player processes to external IP addresses (indicating payload download following successful exploitation)
• Presence of malicious MPEG2 files in user download directories, temp paths, or USB-transferred file collections, identifiable by file structure analysis tools or AV signatures

# Splunk -- detect suspicious child processes spawned by media-handling applications
index=wineventlog EventCode=4688
  parent_process_name IN ("explorer.exe", "wmplayer.exe", "iexplore.exe", "wmpnetwk.exe")
  new_process_name IN ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe", "regsvr32.exe")
| table _time host parent_process_name new_process_name CommandLine
| sort -_time

# Splunk -- detect network connections from media player processes after media file access
index=network sourcetype=sysmon EventCode=3
  Image IN ("*\\wmplayer.exe", "*\\wmpnetwk.exe", "*\\iexplore.exe", "*\\explorer.exe")
  NOT dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
| table _time host Image dest_ip dest_port
| sort -_time

# Suricata -- detect DirectShow exploit delivery via HTTP (malicious MPEG2 served inline)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2009-1537 DirectX quartz.dll MPEG2 Exploit Attempt"; flow:established,from_server; content:"video/mpeg"; http_header; file_data; content:"|00 00 01 BA|"; within:4; content:"|00 00 01 E0|"; distance:0; within:50; byte_test:2,>,512,0,relative; sid:2009153; rev:2;)

# Suricata -- detect outbound callback from exploited media process (payload download)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible Post-Exploitation Payload Fetch from Media Process"; flow:established,to_server; content:"GET"; http_method; content:".exe"; http_uri; content:"User-Agent: Mozilla/4.0 (compatible; MSIE 6"; http_header; sid:2009154; rev:1;)

Timeline

References

• NVD — CVE-2009-1537
• CISA KEV — CVE-2009-1537
• Microsoft MSRC — CVE-2009-1537