A CVE identifier in use is not necessarily public at a given time. It gets published when or after the vulnerability is published.
Does this mean that the "year" included in the CVE ID can frequently be years older relative to the year of the first public report of the vulnerability (and therefore to when the CVE ID becomes available for CVE search at MITRE)? Or is there a mechanism to correlate the year with the year of public disclosure within some limits related to public disclosure?
I am NOT refering to examples like
CVE-2010-5298 which was assigned or maybe just published in 2014, because the vulnerability itself was in some sense public since 2010, just without any CVE ID.
I am refering to a big hypothetical currently unknown bug that will be filling the headlines throughout 2017 but be labelled
CVE-2010-something due to a vendor secretly and knowingly sitting on it for 7 years.