I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet".
As an example: This application uses libxml2 as a DLL distributed in the application directory (as is "usual" on Windows). The libxml2 version used is somewhat dated, but it covers the use cases of the app. Obviously, libxml2 has it's list of CVEs, but the question I'm asking is: does any of this matter?
There doesn't seem to be an attack vector, other than crashing the app itself (locally), by exploiting any security vulnerabilities of such a library.
So what's the answer if someone claims: "You application is insecure because it uses XYZ!!" when all I do is use XYZ in a local user mode app?
This is not just theoretical: It costs to keep all dependencies up to date in new builds. Users need to be advised if they need to update based on these factors.