Hello, thanks for your feedback. The point of vex8s is to avoid fixing all the CVEs at the same time giving them less or more priority depending on their exposure. If you find there's some protection, you can keep that CVE aside to focus more on other with higher priority.