As the Symantec Corporation said in its advisory on the issue dubbed CVE-2016-2208.
No user interaction is required to trigger the parsing of the malformed file.
For exploitation, it only needs to send a specially crafted file, and no further action is required.
