It really appears that this CVE was issued based on that super vague twitter thread.