The bogus CVE problem

Another example is a batch of four recent CVEs for Notepad++: https://securitylab.github.com/advisories/GHSL-2023-092_N...

One of them might be a real vulnerability, but very likely not a 7.8.

The other three are scored 5.5, but look much more like zeroes. Read buffer-overflows that do not cross any confidentiality or other security boundaries and do not have any way to exfiltrate the data anywhere.