The stats you listed are for the percentage of CVE causes out of the total reviewed CVEs (109), which includes those CVE causes Rust can prevent and those that

The stats you listed are for the percentage of CVE causes out of the total reviewed CVEs (109), which includes those CVE causes Rust can prevent and those that are completely language independent causes. I took the stats for those CVEs that Rust is said to prevent, which according to the paper is 59 CVEs. So I took the number of any given cause and took its percentage out of the 59 CVEs that Rust's memory safety guarantees would prevent.