Hi @ocsurfnut,
I understand that the targeting of Windows machines with malware makes this vulnerability concerning for a large population of users. However, vulnerability severity concerns the severity of a vulnerability when exploitation occurs, not the likelihood of exploitation occurring in the first place. The GitHub Advisory Database supports the Exploit Prediction Scoring System (EPSS), which does assess the likelihood of future exploitation.

My colleagues and I believe that the CVSS 3.1 value provided by MITRE, the CNA that issued the CVE, is accurate and provides a reasonable assessment of the severity of the vulnerability. If you have a different assessment of severity based on CVSS 3.1 or CVSS 4.0, you can request a change to the CVE record and contact MITRE, the assigning CNA, at https://cveform.mitre.org/ with your concerns about the CVSS. Thank you for taking the time to make the open source community safer!