Going to assume that this RCE is being actively exploited right now.

A "major" rating seems appropriate for this. If this didn't require QUIC and it was the default config then that would be far worse situation.

Still a serious 0day.