Paint’s image decoding engine is a shared system component and during thumbnail and visual preview generation it gets called automatically without opening the GUI. Ergo it’s enough for a malformed image file to exist on your device to get pwnd.