The Wait for Windows WMF patch...

Microsoft has responded to the identification of the WMF vulnerability by promising to release a patch on January 10th The patch will be released as part of the scheduled monthly release of security bulletins. At the moment it is being localised and quality tested.

Microsoft itself claims that monitoring of the vulnerability shows that attacks are not widespread and limited in scope. At the same time, the lack of an official patch has opened a window of opportunity for malicious users to exploit. It has been reported that there are now dozens of attacks being carried out, ranging from an MSN worm to spam containing links to malicious websites. One suggestion is that at least a million PCs worldwide have already been affected. It has also been claimed that up to 99% of computers worldwide could be vulnerable to this security flaw.

Sources:
ZDNet - Wait for Windows patch opens attack window
Viruslist.com