WMF flaw can’t wait for Microsoft fix, researchers say