In the US, copyright is also more about sharing/uploading than downloading (if I remember right, all of the RIAA lawsuits were for uploading). The bigger issue is if the exploit has you download something that's illegal to possess (eg: illegal pornography).