Two new WMF bugs found
Security experts say latest vulerabilities less serious than the one Microsoft patched last week — Just days after Microsoft (Profile, Products, Articles) Corp. patched a critical vulnerability in the way the Windows operating system renders certain types of graphics files …
Context & Ripple Effects
The WMF crisis has been running for nearly two weeks: researchers counted more than 50 exploit variants in the wild by December 29, an unofficial hotfix circulated before Microsoft responded, and antivirus coverage stayed inconsistent even as exploits spread. Microsoft then issued its own advisory and shipped an out-of-band patch last week.
Now security experts report two additional WMF vulnerabilities — judged less serious than the patched flaw — just days after that fix landed. The discovery keeps the metafile format itself, rather than any single bug, at the center of the story, and syndicated pickup by CNET under a headline about Microsoft hunting for 'new species' of the bug shows how widely the concern travelled.
First-order effects
- Organizations that rushed out Microsoft's emergency patch last week learn it does not close these two newly reported flaws, forcing a fresh triage decision on systems they believed were fixed.
- Antivirus vendors face immediate pressure to add detection for the new bugs, after drawing criticism during the first wave for patchy WMF signature coverage.
Second-order effects
- With experts calling the new holes less severe but the same family, Microsoft comes under scrutiny to audit the rest of its metafile-rendering code rather than patch one defect at a time — the framing behind CNET's 'hunt for a new species' coverage.
- Enterprises that adopted third-party hotfixes during the gap before Microsoft's official patch now weigh whether to keep unofficial mitigations in place against residual risk in the same code path.
Third-order effects
- If each fix surfaces further flaws in the same legacy format, the episode points toward treating old graphics-parsing code as a standing attack surface requiring wholesale redesign or deprecation, not incremental patches.
- The speed of this cycle — zero-day in the wild, community hotfix, out-of-band vendor patch, new findings within days — sets a template for how quickly Microsoft and security vendors are expected to iterate outside the normal monthly patch rhythm.
The trend: Legacy file-format rendering code is emerging as a recurring attack surface that forces vendors like Microsoft into continuous, out-of-band patch cycles instead of scheduled updates.