Depends on who is doing the estimating.
If you're the software producer, the cost is the cost to fix the vulnerability. If you're striving for a mature risk management practice, add in the cost of lost business if the vulnerability is going to damage your sales. Ignore the costs in the next paragraph unless there is some insurance or regulatory regime that will assign those costs to you.
If you're the consumer then a standard, simplistic probability x impact may be adequate (albeit coarse and inelegant, but adequate). Figure out the cost of the breach - what would happen if the vulnerability were to be exploited by the adversary (this will be a range, depending on worst case and most likely case). Then the probability that the adversary will be able to take advantage of the vulnerability. For example, even the worst vulnerability is of limited impact if it only occurs on one airgapped server. Multiply the dollar value x probability to calculate a range of risk exposure.
If you're striving for a mature risk management practice, then you should have (or be actively collecting) data to support the analysis in the prior paragraph.
If you're in the health or safety community, you should already have established methods to calculate this.