It also only affects you if you are issuing the certificate for more than one domain name if I'm reading it right.

What's supposed to happen:

  For each fqdn in the request
    if challenge succeeds (eg dns-01)
      check whether caa record exists
      if (it doesn't) or (it does and allows issue)
        issue certificate

In the step on "check whether caa record exists", instead of using the domain name that is being issued in this loop, it uses the first one it found (or one of them, it's unclear which one). So theoretically, if you wanted a cert for:

  domain1.example.com, domain2.example.com

and you had a CAA record for domain1 that allowed letsencrypt but then a different CAA record was added between the CAA check on domain1 and the CAA check on domain2 (which wouldn't happen because of the bug) you could get a cert for domain2 that the CAA record said not to issue.