I think that's what they're saying.

Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.