except that lately we've had a ton of CVE related to memory, so in practice it's not exactly right.