Once the vulnerability is made public, skilled mal-intentioned computer programmers aka hackers can then look for software that contains the vulnerabiity and try to exploit it before the software vendor is able to close off the vulnerability.
Once made public, any software vendor that uses code containing the vulnerability needs to upgrade their software and close off the ability for the vulnerability to be exploited as soon as possible.
Zero day vulnerabilities can be exploited to carry out various types of cyber attacks including accessing information that should not be accessible, remote code execution, or denial of service attacks. Remote code execution attacks can give the hacker the ability to control the device that the software is running on. Denial of service attacks can render a software service unresponsive, taking down business critical systems that are relied upon by the business and its customers.
The vulnerabilities that can allow for these types of attacks can be caused by code being written that does not adequately protect from them. An example is a buffer overflow. As a software application writes to memory on the device it is running on, if it tries to write something to memory that is bigger than the intended location, it can overflow and write to memory it was not intended to write to. A software developer generally ensures that checks are done to ensure that only data that fits into the intended location can be written. There have been many cases where these checks and safeguards were not implemented, leading to vulnerabilities that can be taken advantage of, once discovered.