Extended support is a paid service in which a vendor continues to provide security fixes for a software version after the original maintainers have ended support for it. It exists for organizations that cannot upgrade immediately, for example because an application depends on an older runtime or because testing a migration takes time. The vendor typically backports fixes into the old version and delivers them as updated packages or builds.
What extended support covers varies. The vendor decides which versions, platforms and severity levels it supports, how quickly fixes are issued, and what the contract requires. It usually concerns security fixes rather than new features, and it may not cover every dependency or every environment in which the software runs.
Having an extended support contract does not by itself prove that a specific vulnerability is fixed in your build. A fix may be delayed, may be available only in a newer build than the one you run, or may not be offered for that version at all. Equally, an unsupported version with no such contract receives no fixes from anyone, so a published upstream fix may never reach it.
If you rely on extended support, confirm in the vendor's advisory that your exact version and platform are covered, install the specific update they list, and verify the running version afterwards. Treat extended support as a way to buy time rather than as a permanent solution, and keep a plan to move to a version that is supported by its maintainers.