Vulnerability details can appear before a patch because many researchers publish on a fixed deadline, whether or not the vendor has shipped a fix. Project Zero, for example, gives vendors 90 days and publishes at the end of that window if there is no patch. Knowing the clock helps you read the news calmly.
How one well known policy works
Project Zero's published policy describes a 90 plus 30 model. The vendor has 90 days after notification to make a patch available. If it patches within that time, details are published 30 days after the patch is available to users. If not, details are published at the end of the 90 days.
There is a grace period: when a vendor cannot patch in 90 days but will do so within 104 days of initial disclosure, a grace period may be granted on request, with publication at 120 days.
Active exploitation changes the clock
The same policy says that when there is evidence of active exploitation against real users, a 7 day deadline replaces the 90 day one, with a 3 day grace period. The reasoning is that defenders are already being hurt, so waiting helps the attacker more than the public.
Other policies differ
Other researchers and coordination teams use other timelines, and some publish by agreement with the vendor. When you read a post, look for the notification date and the stated policy. If neither is given, you cannot tell whether the vendor had a week or a year.
What to do while no patch exists
- Confirm whether you run the affected version.
- Read the advisory or post for mitigations: a setting to turn off, a rule to add, access to restrict.
- Reduce exposure: take the service off the public internet if it does not need to be there, or put it behind authentication.
- Add detection where you can: log the affected endpoint and watch for odd requests.
- Check for a patch daily, and set an owner.
- Record the decision and the review date.
Is early publication irresponsible?
People disagree. The case for deadlines is that they push vendors to fix things. The case against is that details can help attackers before users can protect themselves. For your own team the useful question is practical: given that details are public, what is the fastest way to lower our exposure?
Your own policy
If you publish software, a clear public disclosure policy saves researchers and users from guessing. Decide your timeline and write it down.
Quick check
Does a published deadline mean the bug is being exploited?
No. Deadlines are about publication timing. Exploitation is a separate fact, stated in advisories or catalogs.
Should I wait for a patch before mitigating?
If a mitigation exists and is cheap, apply it while you wait, and remove it only after the fixed version is tested.
Sources
Last reviewed: 19 October 2026.
