Extremely critical!Effected:Microsoft Windows Server 2003 Datacenter EditionMicrosoft Windows Server 2003 Enterprise EditionMicrosoft Windows Server 2003 Standard EditionMicrosoft Windows Server 2003 Web EditionMicrosoft Windows Small Business Server 2003Microsoft Windows XP Home EditionMicrosoft Windows XP ProfessionalMicrosoft Windows Small Business Server 2003Microsoft Windows Storage Server 2003Microsoft Windows XP Tablet PCMicrosoft Windows XP Media Center 2004/2005Microsoft Windows XP Embedded??Microsoft Windows Server 2003 R2 Enterprise EditionMicrosoft Windows Server 2003 R2 Standard Edition

Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.

Description:A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of corrupted Windows Metafile files (".wmf"). This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. selecting the file). This can also be exploited automatically when a user visits a malicious web site using Microsoft Internet Explorer.

NOTE: Exploit code is publicly available. This is being exploited in the wild.

The vulnerability has been confirmed on a fully patched system running Microsoft Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 SP0 / SP1 are reportedly also affected. Other platforms may also be affected.

Solution:Do not open or preview untrusted ".wmf" files and set security level to "High" in Microsoft Internet Explorer.