> The only difference between CVE-2020-0986 is that for CVE-2020-0986 the attacker sent a pointer and now the attacker sends an offset. CVE-2020-0986 had been

> The only difference between CVE-2020-0986 is that for CVE-2020-0986 the attacker sent a pointer and now the attacker sends an offset. CVE-2020-0986 had been discovered in the wild in May. Microsoft claimed to have fixed it, so this was logged as a separate CVE, even though it's essentially the same bug (the fix can be trivially circumvented) and P0 has given it a new 90 day period, which has now ran out. I wouldn't call it too strict, they had much more than 90 days to fix it properly.