That is possibly done by binding the malware in the JPG file or even the JPG file will be able to secretly obtain and operate the malware. This up to date JPG exploit is analogous to MS04-028 but still mysterious by https://www.darkexploits.com/product/extremely-silent-jpg-exploit-new/