in most regions it is not illegal but asking so here would require readers to know exactly what laws apply where you are to answer that adequately from a legal perspective.

i can say, many people do it, some get in trouble because of local laws, others dont because their regions dont have such laws.

if you look at exploitdb and such site they have many exploits also for proprietary things. i would say if you dont outright leak firmware or such IP, an exploit itself is usually not strictly illegal.

its always best to contact a vendor if they are contactable, to both help them fix it and get permission for a post..that way, you can be relatively comfortable you are safe. get it in writing, email is ok.

edit: this is a gray are where the decoder might be considered leaking an algorithm btw. its perhaps not strictly an exploit but some characteristics will be shared around how its perceived to use something not as its intended.