question on vulnerability

[mezzofix]

hi, Obviously not an issue, but just to confirm my understanding, so the vulnerability is a combination of a two vulnerabilities, that is a) arbitrary file creation, and b) code execution vulnerability in the telemetry service that would read and execute the file name which could be nothing else than say a reverse shell that would be run by the telemetry service on its defined schedule? So basically, with executing step a), there's no way to run the malicious code, correct?

THANK YOU!