Reply to post:

Software can have vulnerabilities from things besides programming errors, in fact I'd be willing to bet that most CVEs are malicious combinations of features working exactly as intended.