These CVEs are nonsense, there is no way this is exploitable (in this case even meaningful if it was exploited) by a user that is not already privileged. I do not think we have tried to get the CVE marked as disputed, but it sounds like the CVE process is too weird to expect more than it getting tagging on a "disputed" with a reason...