Proving which vulnerabilities an attacker could actually use, and deciding the right call on evidence, is the hard part.