I'm curious what "don't need to be on the same LAN" means. If it would be exploitable over internet wouldn't you just write that oder even leave the part about LAN out?

So little information. We will have to wait until this is patched to know more about it, won't we.

I don't understand the LAN bit, does this mean 'over the internet'?

A wild stab in the dark: remote code execution using a standard codec/library, easily triggered in the context of an ad.

does this mean that it can be triggered by a web browser ?

Clickbait title? Zero info? Windows is evil! To the front of hacker news we go!