Microsoft has been carefully monitoring the attempted exploitation of the WMF vulnerability since it became public last week, through its own forensic capabilities and through partnerships within the industry and law enforcement. Although the issue is serious and the attacks are being attempted, Microsoft's intelligence sources indicate that the scope of the attacks is limited. In addition, attacks exploiting the WMF vulnerability are being effectively mitigated by anti-virus companies with up-to-date signatures...Users should take care not to visit unfamiliar or untrusted Web sites that could potentially host the malicious code. Additionally, consumer customers should follow guidance on safe browsing.

This is bad. This is very, very, very bad. I'm a loyal, long-time Microsoft customer, and I consider this to be an unacceptably bad response time from the MSRC on making a patch available for what is a serious vulnerability. It's pretty blatantly obvious that this is a *process* problem, not a technological problem. Microsoft can do better than this. This patch should be released before January 10th, even if it's only the English version for XP SP2. Administrators and users will grudgingly accept multiple patches in a short amount of time, if necessary, but allowing them to go weeks without a patch while numerous machines get compromised is, quite simply, a poor business decision.