I believe the window of vulnerability is two week.
Birth. Denoting the flaw’s creation, birth usually occurs unintentionally, during a large project’s development. If the birth is malicious and thus intentional, discovery and birth coincide. By convention, we consider the vulnerability to exist only after there is a nonzero probability of deployment—internal development and testing do not count, only deployment does.
Discovery. When someone discovers that a product has security or survivability implications, the flaw becomes a vulnerability. It doesn’t matter if the discoverer’s intentions are malicious (Black Hat) or benign (White Hat). It is clear that, in many cases, original discovery is not an event that can be known; the discoverer may never disclose his finding.
Disclosure. The vulnerability is disclosed when the discoverer reveals details of the problem to a wider audience. The disclosure may be posted to a vulnerability-specific mailing list such as Bugtraq. A full-disclosure moderated mailing list, Bugtraq serves as a forum for detailed discussion and announcement of computer security vulnerabilities: what they are, how to exploit them, and how to fix them. Alternatively, the product’s vendor or developer may receive news of the vulnerability directly. Obviously, the many levels of disclosure comprise a vast continuum of who was informed and what aspect of the vulnerability the disclosure revealed.
Correction. A vulnerability is correctable when the vendor or developer releases a software modification or configuration change that corrects the underlying flaw.
Publicity. A vulnerability becomes public in several ways. A news story could detail the problem, or an incident response center could issue a report concerning the vulnerability. The key element here is that the vulnerability becomes known on a large scale once the disclosure gets out of control.
Scripting. Initially, successful exploitation of a new vulnerability requires moderate skill. Once a cracker scripts the exploitation, however, those with little or no skill can exploit the vulnerability to compromise systems. Scripting dramatically increases the size of the population that can exploit systems with that vulnerability. Further, although we use the term “scripting” here, this phase applies to any simplification of intrusion techniques that exploit the vulnerability, such as cracker “cookbooks” or detailed escriptions on how to exploit the vulnerability. In essence, at this point the vulnerability has been industrialized.
Death. A vulnerability dies when the number of systems it can exploit shrinks to insignificance. In theory, a vulnerability can die if administrators patch all the systems at risk to correct the flaw, if they retire such systems, or if attackers and the media lose interest in the vulnerability. In practice, administrators can never patch all the systems at risk. They inevitably retire such systems at some point, and attackers and the media frequently lose interest in the vulnerability—but sometimes only temporarily, creating a near-death experience.
William A.Arbaugh University of Maryland at College Park. December 2000. Windows of Vulnerability: A Case Study Analysis
William L. Fithen & John McHugh CERT Coordination Center. December 2000. Windows of Vulnerability: A Case Study Analysis
http://www.cs.umd.edu/~waa/pubs/Windows_of_Vulnerability.pdf