One of those "if I accept that this is a vulnerability that needs scoring, which I do not as no security boundary has been violated, then I can't figure out how you computed 9.4, as to me it looks like a 4.1" kind of days.