CVE are assigned from the year the vulnerability was found. Not when it was announced.
However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.
If you have not read the Equifax Data Breach Report put out by the US Congress, I highly recommend it. The security issues at Equifax went far beyond "failing to apply a security patch."
However, a CNA like Firefox does not allocate CVE as they need them. They first ask Mitre for a block of X CVE to use as they need. They probably got a new block in September.