Sometimes CVSS 10 "oversells" the true severity of a bug but this doesn't seem to be one of those cases.