Looks like there's a new flaw in Windows. One guy has released an unofficial patch. The problem involves WMF images and "[u]nlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image." (See article).

Update: Looks like the patch has been updated.