Has anyone figured out whether this CVE was intentional?