In rare cases when vendor accepts the issue but does not fixes it for a very long time (suggesting they don't care for their users), we might disclose the vulnerability after informing the vendor several times (depending on the vulnerability, long time can range from 3 months to many years and generally speaking, 8 months).