Discovering a zero day implies that there is no patch, but the term is talking about how long the vendor has known about the vulnerability.