CVE-2009-1537

Microsoft DirectX contained a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter allowing remote code execution via crafted media files.

This 2009 vulnerability was actively exploited in the wild and linked to ransomware campaigns, exposing defense contractors to remote code execution through unpatched DirectX components. DIB organizations must verify patch levels on legacy systems and prioritize updates to prevent exploitation of this known, high-severity flaw.

Shame score — The vulnerability was actively exploited in the wild for years before being patched, indicating a significant lapse in vendor response and security hygiene.