> How is a bug that was patched six years ago causing RCE today?

From what I read last night: that patch fixed a specific case (an over-large index that became a negative number) that could trigger the problem, but did not fix the core problem itself. The new exploits try to trigger the problem in another manner, the new patch does address the core issue.