Fortunately, demand for such bugs is pretty low ^, so, $1~2k I guess. ^ this is both a good and a sad indicator, it means the bar of post-exploitation for such

Fortunately, demand for such bugs is pretty low ^, so, $1~2k I guess. ^ this is both a good and a sad indicator, it means the bar of post-exploitation for such a bug (on developers' boxes) is "sufficiently high" that your favorite ransomware gangs are not eager to get on. OTOH it means they have way more "easier" enterprise-y targets...