Technically it is a zero-day since the vendor didn't know about the vuln. "zero-day" has nothing to do with complexity