Follow-up: a CVE identifier has been assigned for this issue.
CVE-2026-110735 — record: https://www.cve.org/CVERecord?id=CVE-2026-110735
The record is tagged "disputed"; the description quotes the supplier
position ("no security issues"). MITRE scored it
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N (2.5). I have filed a
reconsideration request with MITRE's CVE Numbering Authority of Last
Resort (CNA-LR), asking for
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8). NVD analysis is
pending.
Still unpatched upstream as of 2026-10-15.
Tomasz Kaye
