Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2010-1879: DirectX and Windows Media components can run malicious code

CVE-2010-1879 · published 16 years ago

Summary

A flaw in DirectX’s Quartz library, the Windows Media Format Runtime (versions 9, 9.5, and 11), Windows Media Encoder 9, and the Asycfilt component lets a specially crafted video or audio file cause your computer to execute unwanted programs. This could let a remote attacker take control of the system when a user opens or processes the malicious media file. Install the latest security updates from Microsoft and avoid opening media files from unknown sources.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	directx	9.0 9.0a 9.0b 9.0c `cpe:2.3:a:microsoft:directx:9.0:::::::*`
microsoft	windows_media_format_runtime	9 9.5 11 `cpe:2.3:a:microsoft:windows_media_format_runtime:9:::::::*`
microsoft	windows_media_encoder	9 `cpe:2.3:a:microsoft:windows_media_encoder:9:-:x64:::::*`

Original advisory text

Unspecified vulnerability in Quartz.dll for DirectShow; Windows Media Format Runtime 9, 9.5, and 11; Media Encoder 9; and the Asycfilt.dll COM component allows remote attackers to execute arbitrary code via a media file with crafted compression data, aka "Media Decompression Vulnerability."

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.3 Critical

Exploitation

20% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published8 Jun 2010

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2010-1879 · NVD

Track software like this

Free during beta