Is it accurate to call this a leak if no one actually took advantage of the vulnerability?