# Correction: the vendor had publicly described a catalogued flaw that the record said was described nowhere but the catalog

- **Artifact ID:** CHQ-CORR-2026-028
- **Status:** IN FORCE
- **Public record:** https://record.cybersecurityhq.com/corrections/chq-corr-2026-028
- **Machine-record SHA-256:** `761a4938e5a5471a564ba05547c6299061fc530ec88a7429592abad7050bb5eb`

## Complete structured record

```json
{
  "id": "CHQ-CORR-2026-028",
  "class": "CORRECTION",
  "subtype": "editorial",
  "status": "IN FORCE",
  "authority": "DM ratified 2026-11-12",
  "effective": "2026-11-12",
  "published": "2026-11-12",
  "title": "Correction: the vendor had publicly described a catalogued flaw that the record said was described nowhere but the catalog",
  "what_was_wrong": "The record from 31 October 2026, and draft text of both editions of Issue No. 45, said the catalog sentence was the only public description of CVE-2026-118527. That was false at every check, because CHQ had checked the CVE program and the agency's enrichment source and not the vendor.",
  "what_is_true": "The vendor's advisory added the identifier on 29 October with a description, a severity vector and fixed versions. Two further descriptions were published on 2 November. What is absent is the CVE program record and the agency's enrichment record, so the agency's own decision values behind its deadline are not public.",
  "what_changed": "The issue's finding is narrowed to the CVE record and the agency's scoring. The vendor advisory is retained and cited. CHQ does not infer the agency's computation from the vendor's vector.",
  "what_did_not_change": "No count, rating, Outlook or Watch.",
  "control_analysis": "A claim that no public record exists now requires the vendor advisory to have been checked. That is a rule in the run protocol, not a mechanical control.",
  "found_by": "An external review that cited two national CERT bulletins, verified by CHQ against the primaries."
}
```