During a penetration testing engagement, a penetration tester discovers a buffer overflow vulnerability.

Apply for a bug bounty reward from the manufacturer.

Inform the appropriate authorities about the vulnerability before informing the client.

Report the vulnerability to the client and provide recommendations for remediation.

Exploit the vulnerability to demonstrate its impact to the client.