CVE-2003-0346: Microsoft DirectX

High severity, CVSS 7.5. EPSS: 32.7% chance of exploitation in the next 30 days.

Multiple integer overflows in a Microsoft Windows DirectX MIDI library (QUARTZ.DLL) allow remote attackers to execute arbitrary code via a MIDI (.mid) file with (1) large length for a Text or Copyright string, or (2) a large number of tracks, which leads to a heap-based buffer overflow.

Affected products

• Microsoft DirectX: version 5.2 only; version 6.1 only; version 7.0 only; version 7.0a only; version 8.1 only; version 9.0a only

Published 2003-08-27. Last modified 2026-06-16.