As a security professional with over 16 years in the field, and in my role as Chairman of the Scottish branch of the Institute of Information Security Professionals and the President of ISACA Scotland, as well as being one of the moderators over on our very own Security Stack Exchange, I thought I should provide a bit of information as to why Responsible Disclosure is considered essential:
First up, a description of Responsible Disclosure (this one from Dell SecureWorks)
Notifying a vendor prior to releasing information publicly about a
vulnerability is standard practice in the security industry and is
known as “responsible disclosure.” This advance notice allows vendors
to research and fix vulnerabilities before computer criminals are
notified of their existence – keeping the internet safer for business.
Admittedly, some vendors are better than others, but generally if you find a vulnerability in a product, and inform the vendor, they will plan a fix and incorporate it into a later version. There are varying timelines for this, some may take months, some may do it very quickly - faster if it is a critical issue - but giving them the chance to fix it helps all their customers.
If you publish a new vulnerability without giving the vendor time to prepare a fix, an attacker will have an exploit ready incredibly quickly (we see turnaround times in days, or even hours) whereas vendors will have to go through validation, testing, management and rollout to customers.
So you may indirectly cause a large number of people to be attacked - in this case I'm not sure what the worst case scenario would be, but the usual targets include getting bank logins from people's computers.
Would you like to cause the people who use this code to be at risk? Or would you rather defer publication for a month or two and work with the vendor to let them fix the problem?
The actual length of time you wait is a difficult one - some vendors have been known to need a bit of hurrying up, but as noted security expert Bruce Schneier points out, the threat of Full Disclosure does work!
Over on Security Stack Exchange we have this question on how to disclose security vulnerabilities in an ethical fashion.