Sending a BMP file that the user has to open doesn't match what little published details we have:

> The vulnerable system can be exploited without any interaction from any user.

you are right, it seems like the latter outbouns tcp connection is already being opened by paint, and that is what is exploitable.

since it exposes no port, I’d assume it isn’t trivial to exploit, paint will chose its target (a microsoft domain or IP), the exploit must involve some error in destination selection, or simply allowing a mitm to impersonate microsoft.

this is inline with Attack Complexity High, attacker needs to be either in the network path (mitm) or control the erroneous destination of the connection (say mircosoft.com), possibly blocking (dosing) the higher priority genuine destination

Seems odd even for a vibecoded copilot integration to make repeated, unprompted network requests. And if they're not repeated and unprompted, then we don't meet the "no user input" requirement.

pretty standard to check for updates no?

For others, def. For paint, it's always been either OS-updated or store-updated.