apparently WMF can still execute code; http://redxii.blogspot.com/2005/12/vulnerabilities-in-graphics-rendering.html there was a patch for it two Tuesdays ago. It can still execute code even with the aforementioned patch