EDIT: After playing with the CVSS calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
I found that there are two linked items that can cause a vulnerability to jump a whole point: Privileges Required (PR) and User Interaction (UI). It stands to reason that if there is no user interaction then it doesn't require privileges to begin the attack. Conversely, if user interaction is required then privileges must be low or high. These items can make any high severity exploit jump from 8 to 9.
Let's look at how the score is calculated, which is quite complex. It involves the following equation to combine the Exploitability and Impact:
Base Score = Roundup(Min(Impact + Exploitability, 10)) if Scope is Unchanged
Base Score = Roundup(Min(1.08 · (Impact + Exploitability), 10)) if Scope is Changed
To get the maximum Exploitability the vulnerability must have:
Attack Vector (AV) = Network
Attack Complexity (AC) = Low
Privileges Required (PR) = None
User Interaction (UI) = None
TRANSLATION: This says that the exploit must be something fully automated that any Script kiddie can run. It must come across the network, function from a non-privileged account, and have no indication to the user that an exploit is running.
Next we calculate the Impact. To get the highest impact score the vulnerability must:
Have a scope that changes and meet the following impacts:
Confidentiality (C) = High
Integrity (I) = High
Availability (A) = High
The highest Base Score is then 9.8 when Scope is unchanged and 10.0 when Scope is changed.
TRANSLATION: What this says to me is that the exploit must exfiltrate the data, change the data, and make it unusable. The only thing that comes to mind is a some sort of ransomeware that steals the data before it encrypts.
Now that you understand how the sausage is made I hope you understand how rare such an exploit would be.
To learn more, see here: https://debricked.com/blog/2020/02/28/what-is-the-cvss-score/