The flaw can be exploited if the user opens a wrong file or goes to a wrong Web site. Then the attacker can execute code as the user, who is viewing the file or Web site.
This is the type of vulnerability that's been exploited many times, and those two worms are the biggest examples because they had the biggest impact,