MS security bulletin Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488) lists MS products affected including VFP 8.0 and VFP 9.0. It supersedes MS security bulletin MS08-052 - Vulnerabilities in GDI+ Could Allow Remote Code Execution (954593). I blogged about it at GDI+ security updates for VFP 8.0 and VFP 9.0