And when you chain another weak CVE to run the tool in a method that would have previously been a noop?

Security can be a major pain in the ass, and it's pretty often we see CVEs that were low valued suddenly become more urgent when someone finds a better way to use them as an exploit.