@bagder the other one we see is calling assert failures crashes. It's not a SEGV, there's no possibility of data exfiltration or RCE. There's no security exposure, it's just a bug. One that was anticipated hypothetically by the original developer, but whose final disposition wasn't decided upon way back when.
E.g. /* can this even happen? */
They toss in an assert, and it lives quietly in the code for decades before someone definitively shows yes, it can happen...