Technically the vendor responding is the only practical course of action. The customers are not likely going to abandon the software or patch it themselves.

This would only makes sense if the vendor didn't care. But even then its a long uphill battle.