The advisory from Microsoft specifically says it can be exploited over the network with zero user interaction.

The vulnerability predates Copilot. Paint's first vulnerable version (11.0) was released September 2021, Copilot in February 2023.