I would be careful with this line of thought: opening a malformed archive that gets you into user space is often the first step in a chain-of-attacks that ends up winning Pwn2Own, so I think that a 8-ish score makes sense for it. It won't be enough to do much on its own, but for the past decade or so it's been all about chaining enough small things together to get root, rather than single points of failure.
I keep feeling like the entire CVE system is creaking and about to fail- the signal-to-noise on that has gone so far down, the gate-keeper function that MITRE et al are supposed to be providing clearly has fallen apart, but we do need some way of tracking problems and alerting on bugs in commonly reused libraries. So I can see the problems with the current system, I just can't envision the new, better system to build to replace it.
We should track and fix buffer overflows.
And you’re right, I don’t know all the ways this can be combined with other attacks related to the shell.
But when I design a system the security people at work tell me to assume any bad thing can happen in a user process and design the process isolation and policies to contain it.
Entire categories of attacks (Dos) etc are futile to do anything in user space. Just limit resources and call it a day.