Microsoft issues patch for Vista OS build

The patch applies to a Community Technology Preview (CTP) of Vista released in December, a version available to Microsoft Developer Network (MSDN) Universal subscribers and beta testers, according to Microsoft's Web site. Vista isn't due for a general release to the public until later this year.

The fix amends how Windows Vista deals with graphics in the WMF (Windows Metafile) format, as those files could force a machine to run arbitrary code. If opened, WMF files (perhaps disguised with a suffix such as .jpg instead of the usual .wmf) could trigger the execution of code that tries to download more malicious software.

After the WMF vulnerability came to light last month, it caused a somewhat unorthodox response given the danger security experts felt it posed. One researcher created an unofficial patch, which some security organizations advised users to apply immediately. Meanwhile, Microsoft broke with its regular patch schedule, usually the second Tuesday of the month, and issued a fix on Jan. 5, while company officials sought to address concerns it waited too long.