Comment by kristjansson

> Installing the update isn't enough. A running process keeps the old decoder until it restarts, and a container keeps it until you rebuild the image on a patched base and redeploy

Claudeslop aside, it really is a whole new world we’re in now, where the audience of a run-of-the-mill RCE CVE announcement really does need this stated.