[goldfire]

We're only talking about one exploit in one program. CFG doesn't have to be "common" to be relevant, it just has to have been used in that program, which it must be or it wouldn't have been mentioned.