[rasz]

>vulnerability was caused by hh.exe, but they were told that if there was a command injection from hh.exe, a child process should be created under hh.exe, so especially the heap-overflow side of this vulnerability will not be shared with the community.

"Due to community security, it will not be published until the update is passed. Maybe it will never be published :)"

would hardly call this publishing