WMF File Format: What Windows Actually Recorded Back in 1987

Inside the Instruction List Windows Called a Metafile in 1987

A .wmf file doesn't hold a picture the way a photo format does. It holds a recorded list of calls to Windows' Graphics Device Interface (GDI), the drawing layer Microsoft built into Windows 2.0 in 1987, roughly five years before Windows itself had any 32-bit version at all. Each instruction in that list says something like "move here," "draw a line to here," or "fill this shape with this color," and the format was fully written up as part of the Windows 3.1 Software Development Kit in 1992, in a document that's still findable today. Rendering a WMF simply means replaying that list of GDI calls from the top, exactly like handing someone a set of numbered steps and asking them to redraw the picture from scratch.

Every WMF starts with a plain 18-byte header made of 9 WORDs (a WORD being 2 bytes in 16-bit Windows), holding seven fields: whether the file lives on disk or in memory, the header size, a Windows version number, the total file size, how many drawing objects the file uses, the largest single record's size, and one unused field left over from the design. After that header, each individual record follows the same shape — a size value, a function number where the low byte names the GDI call and the high byte counts its parameters, and then the parameters themselves, listed in reverse order. Windows 3.x defined more than 70 distinct GDI functions this way, which is the entire vocabulary a WMF file has available to describe a picture.

Two Numbers That Explain Why the Format Broke on Bigger Screens

WMF's coordinates are stored as 16-bit signed integers, meaning every single position in a WMF drawing has to fit somewhere between -32,768 and 32,767 logical units. Combined with the fact that the format was never built with a real device-independent scaling system, a WMF drawing made for one screen or printer could land in a completely different spot, or at a different size, once opened on different hardware. Aldus Corporation, the company behind PageMaker, tried to patch this with an add-on 22-byte "Placeable Metafile" header, identified by the magic number 0x9AC6CDD7, which bolts a bounding box measured in twips (1,440 twips to an inch), a checksum, and a version number onto the front of an otherwise ordinary WMF.

That Aldus header worked well enough that most WMF files in the wild carry it, but it was never an official part of Microsoft's own specification — Microsoft didn't formally fold placeable-header support into Windows itself until Windows 2000, over a decade after Aldus invented it. Microsoft's own engineering notes on this era describe a messier problem underneath: individual developers had taken to stuffing their own application-specific location, scaling, and identification data directly into unused parts of WMF files, using ad hoc comments and custom headers other software had no way to interpret. That informal, everyone-does-it-differently pattern is the specific compatibility mess the next format, EMF, was built to formally solve.

A Format That Structurally Cannot Encode a See-Through Pixel

Plain WMF has no transparency mechanism whatsoever, not a limited one, not a workaround — the format simply has no field anywhere in its record structure for expressing that part of a shape should be see-through. This is a real, documented step down even from EMF, which at least supports fully opaque transparent regions, and a much bigger gap than EMF+, which supports genuinely semi-transparent colors on top of that. Anyone opening an old WMF logo and finding what should be a transparent background rendered instead as a plain white or black box isn't looking at a rendering bug; that's the format working exactly as designed, since there was never anywhere in the file to record the intent in the first place.

The command vocabulary itself is smaller too: WMF's roughly 70 GDI functions cover basic lines, fills, text, and simple bitmap placement, while EMF expanded that to 97 distinct record types built around 32-bit values instead of 16-bit ones, adding a real color palette, Unicode text support, and access to the complete 32-bit Win32 GDI command set rather than the older, more limited Windows 3.x subset. Every one of these gaps is a direct, checkable consequence of when the format was frozen — WMF recorded exactly what GDI could do in the late 1980s, and nothing that came after.

Where This 1987 Format Still Sits Inside Current CAD, GIS, and Office Software

WMF is still the format many old, binary-era Office documents used natively for embedded clip art and diagrams, which is why opening a legacy .doc, .ppt, or .pub file from the 1990s or early 2000s can surface a WMF object even in a current copy of Word. Outside of Office, Autodesk's own AutoCAD 2024 and 2025 help documentation still describes the IMPORT and WMFIN commands for bringing a WMF file into a drawing as a block, meaning current, actively sold CAD software retains explicit, first-party WMF import support rather than treating it as an unsupported relic. Cadcorp's SIS geographic information system likewise lists Windows MetaFile (*.wmf) as a supported dataset format in its own documentation, though that same documentation is upfront about a real limitation: inside SIS, you cannot snap onto the graphics from an imported WMF dataset, since the format's simple drawing records don't expose the kind of precise vector geometry a GIS snapping tool needs to lock onto.

Scientific graphing software runs into the format from the opposite direction. GraphPad Prism's own support documentation on choosing between WMF, EMF, and EMF+ recommends avoiding WMF entirely wherever a program supports the newer alternatives, specifically citing a reproducible problem where WMF causes fill-pattern scaling issues on bar graphs pasted into PowerPoint — a specific, checkable rendering bug tied directly to the format's limited pattern-fill records, not a vague warning about it being "old."

The Backward-Compatibility Escape Record That Became a Real Security Bug

WMF's escape records were built to let a metafile carry printer-specific instructions, and one of them, SETABORTPROC, let a file specify a custom function to run if rendering the metafile failed partway through. Microsoft kept that escape code working for years for backward compatibility with 16-bit Windows 3.0 programs, and that exact decision turned into a real, tracked vulnerability: CVE-2005-4560 on Windows and CVE-2006-0106 on Wine, both describing how a maliciously built WMF file could get arbitrary code to run simply by being opened, using that same abort-procedure mechanism. Microsoft's MS06-001 security update patched the Windows side of this in early 2006, and it's the specific reason a handful of security-conscious mail and web filters still treat incoming WMF attachments with extra caution even today.

A more recent, unrelated compatibility failure showed up in Adobe InDesign 16.3, released in 2021, which had a documented bug where WMF files exported from AutoCAD failed to load correctly on Windows specifically — a problem Adobe fixed in the following 16.4 release. Anyone hitting a WMF import failure in InDesign today, on an unpatched older version, is running into that exact known issue rather than a corrupted file, and updating InDesign resolves it without needing to touch the WMF itself.

Straight Answers About a Format Older Than Most of Its Readers

Why won't this file open at all on my phone or Mac?
WMF's drawing commands are Windows GDI's own private API from 1987, not any kind of cross-platform standard, so no non-Windows system has ever had native support for it. Converting it to SVG, PNG, or PDF first is the only reliable path onto a Mac, phone, or the web.

What's the real difference between WMF and EMF?
WMF is the original 16-bit format with roughly 70 GDI functions and no transparency support at all. EMF is its 32-bit, 97-record-type successor from 1992, built specifically to fix WMF's device-dependence problems and add real color palette and transparency support.

Is it true a WMF file can contain a virus?
Historically, yes, through one specific flaw: the SETABORTPROC escape record could be abused to run code, tracked as CVE-2005-4560 and patched by Microsoft in 2006. Modern, fully updated software is not vulnerable to this specific issue, but it's why some older security tools still flag WMF attachments.

Why does GraphPad Prism's documentation tell me to avoid WMF?
Their support pages document a specific, reproducible bug where WMF causes fill-pattern scaling problems on bar graphs pasted into PowerPoint, and recommend EMF or EMF+ instead whenever the receiving software supports them.

Does any current software still genuinely need a plain WMF file?
Yes. AutoCAD 2024 and 2025 both document IMPORT and WMFIN commands for reading WMF directly, and GIS software like Cadcorp SIS lists WMF as a supported legacy dataset format, though with real limitations like the inability to snap onto the imported graphics.