Do you have the CVE number? That's not unreasonable per se, but it could be bogus as you say. A CVSS (base) score is a measure of intrinsic severity of the vulnerability in isolation which is somewhat unintuitive.
A high severity CVE can have zero impact on your system because the vulnerable code path is unreachable, and a pair of low severity CVEs in your system components/libraries can compound and create a critical vulnerability in your system.
A high severity CVE can have zero impact on your system because the vulnerable code path is unreachable, and a pair of low severity CVEs in your system components/libraries can compound and create a critical vulnerability in your system.