Yes this is huge.
A researcher found the file shimgvw.dll is vulnerable, so he released a security advisor along with 0-day exploit in his blog on Christmas day, knowing Microsoft's security experts are on holidays, no one to fix it asap.
The problem presents itself when a user views a malicious WMF formatted file, triggering the vulnerability when the engine attempts to parse the file. (check out
http://www.fxfisherman.com/downloads/anything.wmf)
The issue may be exploited remotely or by a local attacker. Any remote code execution that occurs will be with the privileges of the user viewing a malicious image. An attacker may gain SYSTEM privileges if an administrator views the malicious file.