Judging from the statement: VideoLAN is also aware of the issue and is currently working on a patch, though right now I'm going to guess someone quickly glanc

Judging from the statement: VideoLAN is also aware of the issue and is currently working on a patch, though right now I'm going to guess someone quickly glanced at the issue tracker, saw a percentage of work done and presumed "vulnerability: valid" and pressed on with publication without bothering to try reaching JBK for comment. Both sites really ought to update their posts for clarity. Terrible form, IMO --in the interest of security disclosures. VideoLAN does not seem amused about it either: https://twitter.com/videolan/status/1153715138333220864 https://twitter.com/videolan/status/1153715138333220864