NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Exploiting dangling COM registrations enables local privilege escalation on Windows; a public exploit discloses technical details and makes verification of the incomplete fix necessary.
The report adds the attack vector beyond patch information: it is not the viewer that must be compromised; the remotely controlled host can attack the controlling client.