I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?

Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...