RFC 7903

Windows Image Media Types

📅 published September 2016, from ietf

RFC 7903: Windows Image Media Types 🎀

Okay bestie, let's get into this. RFC 7903 is titled Windows Image Media Types 💖. It's an Independent Submission by S. Leonard from Penango, Inc., and it's marked Informational (so not a Standards Track spec 🌸). It came out in September 2016 and it's on the ISSN 2070-1721 📄. The header doesn't list anything it obsoletes or updates, so it doesn't replace or change any other RFC 💅.

Abstract ✨

Okay so this one registers media types for a bunch of image formats from Microsoft Windows 🖼️. The ones we're talking about are image/wmf, image/x-wmf, image/emf, image/x-emf, and image/bmp, which cover Windows Metafile, Enhanced Metafile, and Windows Bitmap formats 🦋. These started out on Microsoft Windows 2.0 and 3.0, and the whole point is that they're meant to be portable between apps and devices. They can hold vector graphics AND raster graphics, which is giving versatile 🌈.

Status of This Memo 📝

Ngl, this part is pretty chill. This doc is not an Internet Standards Track spec, it's just published for info purposes 🌸. It's a contribution to the RFC Series, separate from any other RFC stream 💜. The RFC Editor picked to publish it at their discretion and doesn't say anything about how good it is to implement or deploy 🙈. Documents the RFC Editor approves aren't candidates for any level of Internet Standard, see Section 2 of RFC 7841 for the deets ✨.

For info about its current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc7903 🔗.

Copyright Notice ⭐

Copyright (c) 2016 IETF Trust and the people listed as the document authors. All rights reserved 🫶. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as they're in effect on the publication date 📜. Read those carefully, because they spell out your rights and restrictions for this doc, and you do not want to be the one who skipped it 💀.

Table of Contents 🧚

   1. Introduction ....................................................2
      1.1. Windows Metafiles ..........................................2
      1.2. Windows Bitmaps ............................................3
   2. Windows Metafile Media Type Registration Application ............4
   3. Enhanced Metafile Media Type Registration Application ...........6
   4. Windows Bitmap Media Type Registration Application ..............9
   5. IANA Considerations ............................................11
   6. Security Considerations ........................................11
   7. References .....................................................11
      7.1. Normative References ......................................11
      7.2. Informative References ....................................11
   Author's Address ..................................................12

1. Introduction 🌷

1.1. Windows Metafiles 🎞️

Long before Scalable Vector Graphics even existed, Microsoft Corporation realized it was super valuable to record images in a format its apps and operating systems could render easily, no matter what output device was used 👑. With Windows 3.0 came the Windows Metafile (WMF) format, which can hold vector AND raster graphics in one package 💅. WMF is a binary format built to work on 16-bit machines, and it's basically a sequence of record structures. Each record holds drawing commands, object definitions, and config settings 🍓. When a metafile gets processed, the image can be rendered on a display, sent to a printer or plotter, kept in memory, or saved to some persistent storage 🖨️.

Here's the lowkey genius part: WMF is connected to the Windows Graphics Device Interface (GDI) API, so WMF data gets "played" to a playback device context. It works the same way PostScript does, where the content is treated as an executable program that outputs the original document 🧠✨.

As Microsoft's first 32-bit operating system, Windows NT 3.1 brought an overhaul to the Windows API ("Win32") and to the in-memory formats those APIs ran on 🔥. That's when the Enhanced Metafile (EMF) format was created, and it used 32-bit values where WMF used 16-bit values 💜. Then in Windows XP, Microsoft extended EMF with "EMF+", which added support for Windows GDI+ 🌈.

Honestly, WMF and EMF got tons of implementations because Windows was a huge commercial success in the 1990s 🏆. There's a big body of free and commercially available clip art and other artwork in these formats 🎨. WMF content also shows up non-normatively in certain standards (for example, [OOXML]), and it's common enough that an implementer would almost certainly need to support it for basic interoperability 😭.

Microsoft publicly documented the WMF format as early as the 1992 Windows 3.1 SDK 📚. Since 2007, Microsoft has released the format specs [MS-WMF], [MS-EMF], and [MS-EMF+] under its Open Specification Promise [MS-OSP] 🫶.

1.2. Windows Bitmaps 🦋

Long before Portable Network Graphics (PNG) came along, Microsoft Corporation and IBM Corporation needed a way to record images that their apps and operating systems could render easily on low-end machines (Intel 80286) 💖. The result was the "BMP" format 🌸. It holds a single raster graphic with basic header fields that can be mapped (or "blitted") to locations in memory super easily 🧚. As computing went from 16-bit to 32-bit, BMP evolved to include 32-bit structures ⚡. Then in the '90s, the venerable BMP got boosts with support for extra color spaces, color profiles, and compression formats 🌈. The same basic format can carry 2-bit black-and-white bitmaps with a 1-bit alpha mask from the '80s, and also full-color Ultra HD images on leading-edge displays 🤩. BMP is also a building block of other formats, including Windows Metafiles, Windows Icons, and Windows Cursors 🧩.

BMP got a ton of implementations thanks to Windows' commercial success in the 1990s 👑. Using it for interchange has declined since PNG (for lossless raster graphics) and JPEG (for lossy raster graphics) showed up 📉. Still, a large body of free and commercially available BMP artwork exists 🎨. Windows Icons are a building block of favicon.ico web tech, so an implementer would almost certainly need to support this format for basic interoperability 🙈💅.

Microsoft publicly documented the BMP format as early as the 1992 Windows 3.1 SDK, in the Windows Metafile documentation 📚. Since 2007, Microsoft has released the format spec [MS-WMF], which includes most components of the Windows Bitmap format, under its Open Specification Promise [MS-OSP] 🔓. See Section 2.2.2.9 of [MS-WMF] (DeviceIndependentBitmap Object) 🔍. BMP data starts with a BITMAPFILEHEADER, followed by one of the bitmap headers (BITMAPINFOHEADER, BITMAPV4HEADER, or BITMAPV5HEADER), then optional color table data, bitmap data, and optional profile data, in that order [BMPSTOR] 🧾.

Implementers need to be aware of the [MICE] vulnerability, and to guard against it 🚨😭. Some details are included in the completed registration template 💜.

2. Windows Metafile Media Type Registration Application ✨

Type name: image 🎀 Subtype name: wmf Required parameters: None. Optional parameters:

DEFAULT_CHARSET: okay bestie, this one's the charset you use when the CharacterSet enumeration (see the WMF specification) says DEFAULT_CHARSET. The value is a charset from the IANA "Character Sets" registry, <http://www.iana.org/assignments/character-sets>. If you don't specify it, the WMF spec says DEFAULT_CHARSET means "a character set based on the current system locale; for example, when the system locale is United States English, the default character set is ANSI_CHARSET" (which is Windows-1252, more or less). So when it's not specified, the default charset depends on the system 💅 This optional parameter is brand new to this registration and may not get widespread support for a while. Lowkey, that means EMF instead of WMF (or embedded EMF inside WMF, if the situation really calls for it) is the more sensible pick whenever text is involved 🦋

Encoding considerations: Binary. 🫶

Security considerations:

The Windows Metafile format's security history got super dramatic in 2005-2006 with the disclosure of the Metafile Image Code Execution ("MICE") vulnerability 😭 MICE won the 2007 Pwnie Award for "Mass 0wnage" and "Breaking the Internet" 💀 The official Microsoft security bulletin explains that the flaw happens because Windows Metafiles can set the SETABORTPROC value of the MetafileEscapes enumeration (accessible via the META_ESCAPE record), which allows arbitrary code execution, i.e., "active content" 🔥

Windows Metafiles can contain Enhanced Metafiles using the META_ESCAPE_ENHANCED_METAFILE record, so the security considerations of EMF apply to WMF too 👑

Windows Metafiles are historically very buggy, bestie 🙈 The original goal was to replicate Windows GDI calls, so flaws in GDI, or in a display or printer driver that implements the backend to GDI, could be exploitable. WMF implementations that aren't backed by Windows GDI have different risks. Even if a malicious WMF author doesn't think of the non-Windows GDI implementation as a primary target, WMF has lots of "corner case" records whose processing may not have gotten the same level of scrutiny as the Windows implementation. "Fuzzing" the implementation is appropriate ✨

As a "basic" image format, the image/wmf media type doesn't use executable content and provides no facilities for privacy or integrity. 🌸

Interoperability considerations:

Windows Metafile is the original 16-bit metafile format. It was released in 1990, which some computer historians might call the "zenith" of the desktop publishing revolution 🌈 Because of that, there's a huge body of free and commercially available clip art that's still in use, either on its own or embedded in productivity documents (word processing documents, desktop publishing documents, slideshows, presentations, spreadsheets, and workbooks). For example, references to WMF content show up (non-normatively) in Office Open XML. Saying support for this format is necessary for interoperability would not be an understatement 🍓

Accommodations for comments or arbitrary data storage in Windows Metafiles are basically non-existent 💀 However, Windows Metafiles can contain Enhanced Metafiles using the META_ESCAPE_ENHANCED_METAFILE record, so an implementation that handles Windows Metafiles is also expected to handle enhanced metafile content. Windows Metafiles can store and output text strings (see META_TEXTOUT and META_EXTTEXTOUT records), but the encodings of those strings may be ambiguous. Unicode encodings aren't possible without the DEFAULT_CHARSET parameter defined in this registration 😭

The previously unregistered type image/x-wmf is also in wide use, so it's registered as a deprecated alias 🦋

Published specification:

WMF: Microsoft Corporation, "[MS-WMF]: Windows Metafile Format", v20160714 (Rev 13.1), July 2016, <http://msdn.microsoft.com/library/cc250370>. 📚

Applications that use this media type:

Office productivity applications
Clip art applications
Desktop publishing applications
Some web browsers (e.g., Internet Explorer)

Fragment identifier considerations: None.

Additional information:

Deprecated alias names for this type: image/x-wmf
Magic number(s): D7 CD C6 9A (little-endian DWORD 0x9AC6CDD7) 🧚
File extension(s): .wmf
Macintosh file type code(s): None. A uniform type identifier (UTI) of "com.microsoft.wmf" is suggested.

Person & email address to contact for further information: Sean Leonard <dev+ietf@seantek.com> 💌

Restrictions on usage: None.

Author/Change controller: Sean Leonard <dev+ietf@seantek.com>

Intended usage: COMMON

Provisional registration? No

3. Enhanced Metafile Media Type Registration Application ✨

Type name: image 🎀 Subtype name: emf Required parameters: None. Optional parameters: None. Encoding considerations: Binary.

Security considerations:

Enhanced Metafiles aren't affected by the Metafile Image Code Execution ("MICE") vulnerability, which is a big relief 🥹 There has been no public disclosure of vulnerabilities specific to EMF or EMF+ to date. Neither EMF nor EMF+ is designed to contain "active content." That said, Enhanced Metafiles can contain Encapsulated PostScript (EPS) data, so the security considerations of PostScript processing may also apply to EMF 👀

As the original intent was to replicate Windows GDI calls, flaws in GDI, or in a display or printer driver implementing the backend to GDI, could be exploitable with maliciously crafted EMF content. EMF implementations not backed by Windows GDI have different risks. A malicious EMF author may not consider the non-Windows GDI implementation a primary target, but EMF has many "corner case" records whose processing may not have gotten the same scrutiny as the Windows implementation. "Fuzzing" the implementation is appropriate. It's also possible that EMF+ data is "safe" while EMF data contains an exploit (or vice versa). An EMF+-aware implementation (such as an application designed for GDI+ on Windows XP or above) would skip the "unsafe" data, while another implementation would fall prey to the exploit 🙈

As a "basic" image format, the image/emf media type doesn't use executable content and provides no facilities for privacy or integrity. 🌸

Interoperability considerations:

Enhanced Metafile is the 32-bit metafile format. It was released in 1992 along with Windows NT 3.1 🍓 There's a large body of free and commercially available clip art that's still in use, either independently or embedded in productivity documents (word processing documents, desktop publishing documents, slideshows, presentations, spreadsheets, and workbooks). Saying support for this format is necessary for interoperability would not be an understatement 💅

Enhanced Metafiles have extensive accommodations for comments and arbitrary data storage 🦋 They can store and output text strings. Mercifully, the encodings of these strings are well-defined ✨ Record examples include EMR_EXTTEXTOUTA (US-ASCII), EMR_EXTTEXTOUTW (UTF16-LE), EMR_POLYTEXTOUTA (US-ASCII), EMR_POLYTEXTOUTW (UTF16-LE), and EMR_SMALLTEXTOUT (UTF16-LE or the low-order 8 bits of UTF16-LE -- effectively ISO-8859-1 -- depending on ETO_SMALL_CHARS).

Enhanced Metafiles can contain Encapsulated PostScript (EPS) data in the EpsData object. In that case, the FormatSignature EPS_SIGNATURE (0x46535045, in little-endian) is used instead of ENHMETA_SIGNAUTRE (0x464D4520, in little-endian) 🧚

Windows XP introduced the GDI+ API, along with EMF+. EMF+ is actually an embedded format, in which GDI+ commands are stored as EMF comment records (EMR_COMMENT_EMFPLUS record type). Content containing EMF+ data can be identified as either:

"EMF+ Only": only EMF+; the EMF records are not sufficient to reconstitute the drawing.
"EMF+ Dual": when played back, both EMF records alone or EMF+ records alone are sufficient to reconstitute the drawing.

Support for EMF+ records may not be as extensive as support for the original EMF records 🌈

The previously unregistered type image/x-emf is also in wide use, so it's registered as a deprecated alias 🫶

Published specification:

EMF: Microsoft Corporation, "[MS-EMF]: Enhanced Metafile Format", v20160714 (Rev 12.0), July 2016, <http://msdn.microsoft.com/library/cc230514>. 📚

EMF+: Microsoft Corporation, "[MS-EMFPLUS]: Enhanced Metafile Format Plus Extensions", v20160714 (Rev 14.1), July 2016, <http://msdn.microsoft.com/library/cc230724>. 📚

Applications that use this media type:

Office productivity applications
Clip art applications
Desktop publishing applications
Some web browsers (e.g., Internet Explorer)

Fragment identifier considerations: None.

Additional information:

Deprecated alias names for this type: image/x-emf
Magic number(s):

01 00 00 00 (little-endian DWORD 0x00000001), corresponding to
the EMR_HEADER Type field.
The next field (EMR_HEADER Size) should be at least 88 (little-
endian DWORD 0x00000050).

File extension(s): .emf (for both EMF and EMF+ content)
Macintosh file type code(s): None. A uniform type identifier (UTI) of "com.microsoft.emf" is suggested.

Person & email address to contact for further information: Sean Leonard <dev+ietf@seantek.com> 💌

Restrictions on usage: None.

Author/Change controller: Sean Leonard <dev+ietf@seantek.com>

Intended usage: COMMON

Provisional registration? No

4. Windows Bitmap Media Type Registration Application ✨

Okay bestie, this is the bitmap one, and honestly it's giving classic 🎀

Type name: image 🦋

Subtype name: bmp 🌸

Required parameters: None. 💖

Optional parameters: None. 💖

Encoding considerations: Binary. 🤖

Security considerations:

Bitmaps have a mostly unremarkable security history. 🙈

Okay so here's the tea: BMP data can encapsulate JPEG or PNG data (the BI_JPEG and BI_PNG values of the Compression enumeration in Section 2.1.1.7 of the WMF specification). That means the security considerations of JPEG and PNG processing may also apply to BMP. Lowkey important, so don't skip it! 👀

Also, as a "basic" image format, image/bmp does not employ executable content and provides no facilities for privacy or integrity. No cap, it's just a simple picture format. 💅

Interoperability considerations:

Uncompressed Windows Bitmaps can be rather large, bestie. 🐘 If there is a need to compress an image, modern applications should consider emitting JPEG or PNG data instead of embedding them in BMP payloads. ✨

Published specification:

WMF: Microsoft Corporation, "[MS-WMF]: Windows Metafile Format", v20160714 (Rev 13.1), July 2016, <http://msdn.microsoft.com/library/cc250370>. 📚

BMP: Microsoft Corporation, "Bitmap Storage", MSDN ID dd183391, <http://msdn.microsoft.com/library/dd183391>. 📚

Applications that use this media type:

Office productivity applications, clip art applications, desktop publishing applications, web browsers, and graphics processing applications. 🖥️🌈

Fragment identifier considerations: None. 🧚

Additional information:

Magic number(s):

42 4D ("BM")

That's the "bitmap" vibe. The next field (BITMAPFILEHEADER bfSize) is a little-endian DWORD indicating the size of the bitmap content in bytes. 🔥

File extension(s): .bmp, .dib 🍓

Macintosh file type code(s): "BMP ", "BMPf", or "BMPp". Apple has promulgated a uniform type identifier (UTI) of "com.microsoft.bmp". 🍎

Person & email address to contact for further information:

Sean Leonard <dev+ietf@seantek.com> 💌

Restrictions on usage: None. 💖

Author/Change controller: Sean Leonard <dev+ietf@seantek.com> 👑

Intended usage: COMMON

Provisional registration? No

5. IANA Considerations 🧚

IANA has registered the media types image/wmf, image/x-wmf, image/emf, image/x-emf, and image/bmp in the standards tree using the applications provided in Sections 2, 3, and 4 of this document. Bestie, that's five media types all official now! 🎉

6. Security Considerations 🔐

See the registration templates for their respective security considerations. 👀

The Metafile Image Code Execution (MICE) vulnerability won the 2007 Pwnie Award for "Mass 0wnage" and "Breaking the Internet" [PWNIES07]. 💀 Yes, that's a real award, and yes, it's as dramatic as it sounds. Take security seriously, babes! 🚨

7. References 📚

7.1. Normative References

[BMPSTOR] Microsoft Corporation, "Bitmap Storage", MSDN ID dd183391, <http://msdn.microsoft.com/library/dd183391>.

[MS-EMF] Microsoft Corporation, "[MS-EMF]: Enhanced Metafile Format", v20160714 (Rev 12.0), July 2016, <http://msdn.microsoft.com/library/cc230514>.

[MS-EMF+] Microsoft Corporation, "[MS-EMFPLUS]: Enhanced Metafile Format Plus Extensions", v20160714 (Rev 14.1), July 2016, <http://msdn.microsoft.com/library/cc230724>.

[MS-WMF] Microsoft Corporation, "[MS-WMF]: Windows Metafile Format", v20160714 (Rev 13.1), July 2016, <http://msdn.microsoft.com/library/cc250370>.

7.2. Informative References

[MICE] Microsoft Corporation, "Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919)", MS06-001, V1.0, January 2006, <https://technet.microsoft.com/library/security/ms06-001>.

[MS-OSP] Microsoft Corporation, "Open Specification Promise", February 2007, <https://msdn.microsoft.com/en-us/openspecifications/dn646765>.

[OOXML] Ecma International, "Office Open XML File Formats", Standard ECMA-376, Fourth Edition, ISO/IEC 29500, December 2012, <http://www.ecma-international.org/publications/standards/Ecma-376.htm>.

[PWNIES07] Pwnie Awards LLC, "Winners of Pwnie Awards 2007", 2007, <http://pwnies.com/archive/2007/winners/>.

Author's Address

Sean Leonard Penango, Inc. 5900 Wilshire Boulevard 21st Floor Los Angeles, CA 90036 United States of America

Email: dev+ietf@seantek.com URI: <http://www.penango.com/> 🦋💜

📦 where this page comes from

ietf: rfc7903 2016-09
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms