Submitted by: @pcisar

Depends on CORE6525

This security-sensitive bug was reported to me privately, and I see no use in making it publicly known before release of fixed version and giving people time to upgrade. Details as always in restricted access.