The parser problem made it worse, but it was neither necessary nor sufficient for the vulnerability. We are fixing it, but decided to leave it out of the critical release path. See https://lore.kernel.org/git/20200414214304.GA1887601@coredum...