Starting with an isolated POC showing the vector being exploited would help. I like gooogle project zero mainly for this.