Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.

This site doesn't do jokes

When they find a CVE RCE in minesweeper then you know it’s all over

Of course the valuable link is down-weighted/buried in the HN discussion...

  >Publicly disclosed
  >No

  >Exploited
  >No

  >Exploitability assessment
  >Exploitation Less Likely