From what I understand, the vulnerability had already been exploited in the wild. Voxelity discovered it thanks to it being exploited at a client's system.