critical zero-day vulnerability