Can you be liable for damages? Under Tort Law, yes.
Let's assume someone developed a virus based on your code. The virus caused millions of dollars of damage. The plaintiff (software vendor) can argue that:
- You have a Duty of Care
to avoid acts or omissions which you can reasonably foresee are
likely to injure your neighbor
Donoghue v. Stevenson (1932) (UK)
The concept of Duty of Care is also found in U.S. law, for example in MacPerson v. Buick Motor Co. (1916), which established that negligence does not require a contract.
- Breach of Duty: A reasonable person can foresee that the "proof of concept" can cause harm. The act of releasing code, therefore, falls short of the expected standard. If you are a IT professional, it is going to be difficult to defend this point.
There is a causation relationship between your code release and the resulted damage.
You are liable for negligence.
Damage: It is likely that users will sue the software vendor for their loses. The software vendor will then sue you, since because of you, the software vendor has to compensate to its customers.
This, of course, depends on what exactly did you release to the public. For example, if significant effort is needed to convert your "proof of concept" to an actual exploit, and you have provided a workaround to avoid this vulnerability, you may defend yourself by arguing that the cause and effect linkage is too remote.
So I must keep the report private? What if the software is open source?
Not really. You should take reasonable measure to ensure that your "proof of concept" is not an actual exploit, and a hacker needs considerable time to develop a functioning malicious software. CVE is a platform where vulnerabilities are publicly shared.
What if you have given the vendor reasonable time to fix the vulnerability?
It does not matter (to you) if time has been given for the vendor to fix the vulnerability. It does matter for the vendor, because if something happens later, the vendor is liable for knowing the problem well in advance and have not allocated the appropriate resources to correct the problem.
To demonstrate a vulnerability exist does not require instruction of how to utilize this vulnerability. For example you can record a video showing the effects of the hack.
Here (link dead, copy on paste-bin) is an interesting read about Motorola taking matters into their own hands after they discovered a vulnerability on the Xerox CP-V system and Xerox did not patch the problem.