Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.

Of course the valuable link is down-weighted/buried in the HN discussion...

  >Publicly disclosed
  >No

  >Exploited
  >No

  >Exploitability assessment
  >Exploitation Less Likely

When they find a CVE RCE in minesweeper then you know it’s all over

"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."

Still, the question remains... How?

I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?

Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...

Maybe because a .bmp file could be sent remotely.

Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.

Because the definition of "remote" has been expanded in the name of resume-driven development to include sending a malicious file that a victim has to open.