Apparently they won't get CVEs ahead of time, so they'll have to patch them themselves once they are made public.