Usually this sort of bug would fall under "next point release". No privilege escalation, no potential for leaking private data - i.e., no giant legal/PR disaster waiting to happen means they will likely defer a patch until the next scheduled point release.