CVE Scope Is The Patcher

A vulnerability disclosed against the maintained downstream of an unmaintained upstream. The fork's maintainers patch and file the CVE under the fork's coordinates; the upstream ships the same code, has no maintainer to triage the report, and remains unflagged in vulnerability databases. The CVE record's affected-products field reflects who responded, not where the bug runs.