Is it legal to buy a vulnerability without using it against users?
<p>Is it legal in the United States to buy a vulnerability in a well-known software but without using it in the wrong way? like exploiting it against users.</p>

<p>It must be legal. Three reasons.</p>

<ul>
<li><p>Paying to be told information capable of misuse is commonplace. Journalists can do it. </p></li>
<li><p>Many big software companies publicise schemes where they will at to learn of vulnerabilities (in their own software but legally that isn't important, it would be legal if not their software as well.)</p></li>
<li><p>Security researchers may pay to learn of vulnerabilities.</p></li>
</ul>

<p>It's not likely one could criminalise one aspect without criminalising others, and the crime is misuse, not paying to learn of misusable information.</p>

<p>HOWEVER...... it may be seen as evidence of criminal intent. If so there might be interest in seeing if you have a likely criminal intent, or other criminal connections. But the act in the OP would not inherently be illegal.</p>

software hacking