WMF Vulnerability - Code vs Data
Tuesday, 3 January 2006
F-Secure’s weblog explains how WMF’s vulnerability arises from a feature that lets the WMF VM execute x86 code through Escape() function.
When Windows Metafiles were designed in late 1980s, a feature was included that allowed the image files to contain actual code. This code would be executed via a callback in special situations. This was not a bug; this was something which was needed at the time.
This vulnerability arises because the WMF VM exposes the entire CPU’s VM as an executable library. Similar problems exists with Word Macro Viruses, where the entire VBA library is exposed to untrusted code.
