Format String Vulnerability

Passing attacker text as a printf-style format string, reading or writing arbitrary memory.

Specifications & Metrics

cwe

CWE-134

impact

High

Core Principles & Analysis

• A lone %n in a log line can write to memory; a stack of %x reads it out.
• Rose to fame in the early 2000s against FTP and logging daemons.
• Fixed by never letting user input become the format argument.