Microsoft released the patch as security professionals started to take the software giant to task for what they perceive as a slow response to a critical security issue. The flaw in the WMF format concerned many security experts over the holidays because the vulnerability can be exploited in Internet Explorer by serving up specially-crafted images from a malicious Web site. The Mozilla Corporation’s Firefox browser does not immediately run code but reportedly asks permission to display the malicious images.