This critical NULL byte overwrite vulnerability in Microsoft DirectX is confirmed to be actively exploited, enabling remote code execution through malicious media files.

This is a memory corruption vulnerability involving a NULL byte overwrite. It requires no authentication and is triggered by a user opening a specially crafted QuickTime media file.

With a CVSS score of 9.5, this vulnerability represents a severe threat to workstation security. It has been historically leveraged in drive-by download and spear-phishing campaigns to gain unauthorized access and deploy secondary malware payloads.

Immediate Action: Apply the security update defined in Microsoft Security Bulletin MS09-028 to all affected systems.

Proactive Monitoring: Review web proxy and email gateway logs for traffic related to media file downloads and unusual outbound connections from browser or media player processes.

Compensating Controls: Utilize endpoint security software to block the execution of files that trigger known DirectX exploitation techniques and disable unnecessary media parsing features.

Public Exploit Available: Yes — confirmed via historical intelligence and CISA KEV listing.

Given the critical impact and active exploitation, immediate patching is required. Organizations should ensure that all legacy systems are updated or transitioned to modern, supported operating systems that are not susceptible to this specific DirectX vulnerability.