The final word on the Windows Metafile (WMF) vulnerability can be found at Steve Gibson's terrific new WMF page.  He also has a new utility to test for the problem.

See Microsoft Security Bulletin MS06-001 for details on the official patch.

Steve's research establishes that no patch is required for Windows 95, 98, 98se, or ME.