I hope this question is not OT for RE, but I'm rather curious as to how vulnerabilities are usually found.Of course I'm aware that companies are doing code audits to identify security problems but I doubt that the results of such audits are publicly made available. Another way to find potential attacks is of course thinking about the details of a particular technique and finding its weakness (a timing attack would probably qualify as such).However, in the case of buffer overruns, I'm always wondering how people find out about it. I mean, if there is a release of some software, reversing it and hoping to find a buffer overflow this way seems rather hopeless to me, considering how much work this is. If your software crashes because of some special input, then of course this can be analyzed and might result in a security vulnerability. So are malware author just monitoring various sources (bug reporting site or similar) in the hope of hearing about such cases to look into it? Somehow I can't believe it.
How are vulnerabilities (especially buffer overruns) found in the wild?
exploit
Most vulnerabilities in closed-source products are found via fuzzing and static reverse engineering.reversing it and hoping to find a buffer overflow this way seems  rather hopeless to me, considering how much work this isTypically you don't need to analyze the entire program, but only the entrypoints for user-input. Yes, it's still a lot of work, but if the results are fruitful then that's all that matters.So are malware author just monitoring various sources (bug reporting  site or similar) in the hope of hearing about such cases to look into  it?Most malware does not propagate via security exploits, but by simple social-engineering (here, run this .exe). For malware that does exploit security vulnerabilities, the authors either rely on modules from Metasploit or buy exploits from the black market. It's extremely rare for a single person to be both a vulnerability finder and a malware author.