component not present inline mitigations already exist vulnerable code cannot be controlled by adversary vulnerable code not in execute path vulnerable code not present