Local privilege escalation vulnerabilities are not rated with critical severity because they require an attacker to already have some access to execute code on the operating system.

At the same time, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaws, tracked as CVE-2020-3433 and CVE-2020-3153, to its Known Exploited Vulnerabilities Catalog that all government agencies have a deadline to patch.