[jtl999]

I thought Zerodium (as an example) was only interested in RCE type vulnerabilities, although I could see others being of value as well.

[mises]

Zerodium might generally traffic in RCE because they're typically of the highest value. They would likely judge that to be of comparable value to some RCEs, if for no other reason because of the number of devices affected. Zerodium also isn't the only one out there.