Applications have unknown vulnerabilities. Good guys and bad guys are working diligently to find what these vulnerabilities are. The good guys will notify the application developer once found, while the bad guys will look to exploit the vulnerability.
A zero day vulnerability is one that is suddenly identified but up to that point no one knew that vulnerability existed. It takes time for the developers to patch this vulnerability, and additional time for users to patch their systems once the developers create a patch. Attackers can exploit this vulnerability in the meantime.
