[orwin]

Local attack vector without privilege escalation should downgrade cve from high to low, and moderate to 'not a cve'.