That would still be an RCE in the default install under certain circumstances, and the security advisory has no legible description or mitigations for an issue that other vendors have patched two weeks ago.

I would be perfectly ok if they had either quietly patched it earlier (like Debian), or communicated their prioritization, or they inexplicably delayed it but provided a high quality advisory (like Red Hat).

I don't like complaining about my fellow security engineers, but this one was real bad and is still personally affecting me.