Risk: High
Microsoft identifies seven critical issues and two important issues in December's Patch Tuesday:
The most severe flaws are found in GDI. Exploitation of these vulnerabilities could allow remote code execution if a user opens a specially crafted WMF image file.
Other critical vulnerabilities affect Windows Search, Internet Explorer, Visual Basic 6.0, Microsoft Word and Excel, all leading to the possibility of remote code execution.
Microsoft also identifies five important issues in December's Patch Tuesday; the most severe of which is a vulnerability in Microsoft Office SharePoint Server which may cause elevation of privilege if an attacker bypasses authentication by browsing to an administrative URL on a SharePoint site. A successful attack leading to elevation of privilege could result in denial of service or information disclosure.