My money is on a particularly bad/exploitable CVE that they want to patch as widely as possible before giving specifics.