# Format String Bug

> Format-string vulnerabilities: read/write primitives via %n/%s, GOT overwrite, modern compiler constraints.

- Skill: `netvar1337/format-string-bug` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/format-string-bug`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/format-string-bug/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/format-string-bug

---


# Format-string bugs

## Find
- `printf(user)` / `fprintf(log, user)` / logging wrappers
- Missing format in `sprintf` family

## Primitives
- Leak stack/code via `%p`/`%s`
- Write via `%n`/`%hn`/`%hhn` (if still reachable)
- Direct parameter access `%N$p`

## Modern reality
- Many compilers warn/forbid; still appears in custom loggers and embedded
- Prefer leak → ROP rather than heavy `%n` on hardened hosts

## Pair with
`stack-buffer-overflow`, `exploit-dev`.