Paint’s image decoding engine is a shared system component and during thumbnail and visual preview generation it gets called automatically without opening the GUI. Ergo it’s enough for a malformed image file to exist on your device to get pwnd.

Every program which has telemetry can. And web browsers.

If I had to guess, without diffing old/new, it's probably related to the generative erase/ai shit.

To stack assumptions, I'd reach for something like using the recent certificate circus to present as there being an updated version of whatever model it uses on the PCs that can run it locally to give it a fucked up model that does the out of bounds shit as part of whatever verification/checks it does after its downloaded/installed.

Either the description or the impact is wrong. You can't trigger MS Paint in a '0-click' attack, and OOB read are not sufficient to directly obtain code execution. So I'll let you guess which one is wrong.

It's quite common with vulnerabilities found by IA, there might be less hallucination, but the impact/score is often completely wrong.

Finally MS Paint has entered the OPSEC battle royale currently being waged.