The Windows metafile (WMF) vulnerability that forced Microsoft to hurry an out-of-cycle patch to the public is still a threat because many home users have not yet fixed their PCs, one security firm warned today.