Is it legal in the United States to buy a vulnerability in a well-known software but without using it in the wrong way? like exploiting it against users.
It must be legal. Three reasons.
Paying to be told information capable of misuse is commonplace. Journalists can do it.
Many big software companies publicise schemes where they will at to learn of vulnerabilities (in their own software but legally that isn't important, it would be legal if not their software as well.)
Security researchers may pay to learn of vulnerabilities.
It's not likely one could criminalise one aspect without criminalising others, and the crime is misuse, not paying to learn of misusable information.
HOWEVER...... it may be seen as evidence of criminal intent. If so there might be interest in seeing if you have a likely criminal intent, or other criminal connections. But the act in the OP would not inherently be illegal.
Although your question pertains to "buying from US" and does not provide any details of where you are located or against which jurisdiction you wish to use it against, it is tough to provide a clear answer. Are you planning to buy from US and "test" against some person or organisation in the USA ?
Notwithstanding the above, suffice to say that in the United States, the Computer Fraud and Abuse Act (CFAA) criminalizes certain activities on or by a computer. See U. S. v. Ross William Ulbricht.
Bonus bedtime story:https://antilop.cc/sr/trial/