CVE-2008-1585: Apple Quicktime

Medium severity, CVSS 6.8. EPSS: 4.1% chance of exploitation in the next 30 days.

Apple QuickTime before 7.5 uses the url.dll!FileProtocolHandler handler for unrecognized URIs in qt:next attributes within SMIL text in video files, which sends these URIs to explorer.exe and thereby allows remote attackers to execute arbitrary programs, as originally demonstrated by crafted file: URLs.

Affected products

• Apple Quicktime: up to and including 7.4.5

Published 2008-06-10. Last modified 2026-06-16.