One does not "discover" a CVE like this. To discover a CVE would mean you searched for a particular piece of software and found it vulnerable according to the NVD. That's not a novel discovery by any means.

What they did is they found bugs and that they were exploitable in certain edge cases. As the bugs turned out to be vulnerabilities, they were assigned a CVE in the NVD with low severity.

IMHO Aisle stockedpiled too much in the marketing shelves.