Windows Exploit - WMF

Ad: This forum contains affiliate links to products on Amazon and eBay. More information in Terms and rules

Not open for further replies.


Mar 10, 2003
Florida, USA
There is a new exploit out which affects all windows versions, and only requires viewing of an image to become infected. Please read up on this exploit and be very careful in vewing images. The F-Secure blog has some good info ( ), and windows currently has no patch released but they do have a workaround available at located in General Info > Suggested Actions.

A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error in the handling of Windows Metafile files (".wmf") containing specially crafted SETABORTPROC "Escape" records. Such records allow arbitrary user-defined function to be executed when the rendering of a WMF file fails. This can be exploited to execute arbitrary code by tricking a user into opening a malicious ".wmf" file in "Windows Picture and Fax Viewer" or previewing a malicious ".wmf" file in explorer (i.e. opening a folder containing a malicious image file).

The vulnerability can also be exploited automatically when a user visits a malicious web site using Microsoft Internet Explorer.

NOTE: Exploit code is publicly available. This is being exploited in the wild. The vulnerability can also be triggered from explorer if the malicious file has been saved to a folder and renamed to other image file extensions like ".jpg", ".gif, ".tif", and ".png" etc.

The vulnerability has been confirmed on a fully patched system running Microsoft Windows XP SP2. Microsoft Windows XP SP1 and Microsoft Windows Server 2003 SP0 / SP1 are reportedly also affected. Other platforms may also be affected.
Description From

Info Sites:
Lol, i recall someone bringing up an old thread from the introduction and it confused people enough to start saying welcome to the forum again
Not open for further replies.

Users who are viewing this thread