I agree, I don't think this is remotely-exploitable so I'm not planning on requesting a CVE number for it.