It's bizarre that you're doubling down in the face of statements from Microsoft's security experts who have the full context of the investigation and the source code. It's worth some self-reflection on what drove you to make this post.
replyThe boilerplate FAQ text is frequently wrong or incomplete. You can go through the catalog and look through some of them and see how many have multiple revisions. I think, if you want to know definitively, you have to patch diff it
replyWhere does it say that you can't be phished with a bmp file?
replyMaybe you should self-reflect on why you are offended by my comment. You might learn something about yourself.
It says that "no user interaction is required", so phishing is explicitly not what this vulnerability is about.
replyYou haven't declared any privileged knowledge of this attack or MS Paint and have, on vibes, doubled down on what you assume must be going on despite other evidence.
It's a bad look.
Look away then.
replyYou don't have to comment on other people's comments you know.
Phishing with .bmp files existed for a very long time now.