It's probably a way to get phished, if you click on a malicious bmp file.
MSRC[1] says otherwise:
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
loading story #50391734