IrfanView 3.99 allows remote malicious users to cause a denial of service (application crash) via a malformed WMF file.
irfanview irfanview 3.99