Nov 1, 2026, 2:36 AM@siddhesh_p There are lots of defects that get CVEs where it is practically impossible to write a working exploit in known configurations of the software. They're given them CVEs anyway with descriptions like "this is most likely an availability risk but arbitrary code execution cannot be ruled out." Those often get high scores because C:H/I:H/A:H.
@msw we've had to deal with many of those in the glibc CNA; I suspect libraries experience this more than applications. To compensate, we try to explain the flaw in more detail so that distributions hopefully see that it's not an issue in practice.
Although I doubt anybody reads anything beyond CVSS nowadays.
Nov 1, 2026, 2:42 AM@siddhesh_p especially when a vulnerability starts trending on social media and across all the influencer blogs and cybersecurity feeds, few people are looking for the details at that point.
They just want the patch, as fast as they can get it.