This is very misleading. There is nothing inherently vulnerable about metafiles. This is demonstrated by the fact that all proper metafile processing works just fine today, after Microsoft patched Windows to remove the previously hidden MICE behavior.

The TRUTH is that "the vulnerability" was introduced when Microsoft silently changed a function in metafile processing to allow execution of image code. After it became public knowledge they changed it back, and all is well.
Okay . . . So now Microsoft says that they already knew about the "potential danger of this type of metafile record", but — for some unexplained reason — they chose not to fix it, as they have now done. Instead, they told Internet Explorer not to process those "potentially dangerous" metafile records.

The TRUTH is that none of these "potentially dangerous" Escape functions are needed inside metafile images at all, as proven by the fact that Internet Explorer has never processed them. And neither are they truly dangerous when they are written to function as specified and documented (and as they originally did operate).

But, again, rather than remove these functions, which Microsoft says they believed were dangerous, they not only remained inside Windows, but were intentionally altered, as we saw above, to allow metafiles to run executable code. (For some reason, Microsoft MADE them dangerous.)
Yep, I got that wrong. Stephen Toulouse and Microsoft are completely correct on this count.

My original vulnerability test metafile contain only a single SETABORTPROC record. Mark Russinovich also independently confirmed that this was the reason for what I encountered in my preliminary experiments. (See Mark's eMail to me.)

GRC's "MouseTrap" and "MouseTrapCmd" utilities use a six-record metafile where setting proper lengths for the metafile records works as expected and successfully triggers the metafile image code execution behavior.
This conclusion to the MSRC blog posting is the most confusing and disingenuous set of statements of all. Microsoft MUST know what I and others have determined after careful examination of Windows 9x: All systems before Windows NT are absolutely not vulnerable to abuse of the SETABORTPROC function because in all those earlier systems it works the way the documentation states, and is incapable of running code in a metafile image. Does Microsoft hope to deliberately frighten the millions of people who are still happily using Windows 9x into upgrading to newer operating systems?

Microsoft also states that Windows 9x platforms are "not vulnerable to any 'Critical' attack vector" because they take additional protective steps. This would lead any reasonable reader to ask why the later, now-vulnerable versions of Windows have had these beneficial "additional protective steps" removed?