OpenGL is a low(ish) level hardware interface, that is almost certainly implemented in legacy unsafe code, so it will be fertile ground for CVEs. Presumably this is a security fix gone wrong