The definition of an exploit:

A software tool designed to take advantage of a flaw in a computer system, typically for malicious purposes such as installing malware.

The definition of a zero-day vulnerability:

A zero-day (also known as zero-hour or 0-day) vulnerability is an undisclosed computer-software vulnerability that hackers can exploit to adversely affect computer programs, data, additional computers or a network.

Is it illegal to create and sell a exploit of a zero-day vulnerability?

  • What jurisdiction? If in the US, what state? – Mr_V Jul 12 '16 at 12:41
  • @Mr_Vitale The Netherlands, Europe. Also I'm interested in what the laws that apply about this in other countries. – Bob Ortiz Jul 12 '16 at 13:52


In the United Kingdom it is illegal under the Computer Misuse Act 1990.

In other jurisdictions there may not be a law directly aimed at computer crime but if you sell it knowing that a crime is going to be committed with it that makes you an accomplice. Most computer crime is prosecuted under laws not directly aimed at computer misuse.

  • I fail to see how it would be illegal under this act. Selling 0days does not constitute unauthorized access. – forest Nov 8 '18 at 11:08
  • The CMA makes it illegal to distribute software that enables someone else to commit other crimes under the CMA. It also makes illegal the learning and teaching of methods of computer misuse. So unless the 0day is only able to be used on a computer that you have authorisation for (this is not possible) then it comes under the CMA – Topher Brink Nov 22 '18 at 4:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.