# Format String Vulnerability

> Detects format string vulnerabilities where user-controlled input is passed directly as the format argument to printf-family functions.

- Skill: `zakirkun/format-string-vulnerability` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/format-string-vulnerability`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/format-string-vulnerability/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/format-string-vulnerability

---


# Format String Vulnerability

## Overview
Format string vulnerabilities occur when user-controlled data is passed as the format argument to `printf()`, `sprintf()`, `fprintf()`, etc. Attackers can:
- **Read stack memory**: `%x %x %x %x` dumps stack values, leaking addresses and secrets
- **Write to arbitrary memory**: `%n` writes the number of bytes printed so far to a pointer on the stack
- **Remote Code Execution**: By writing to the GOT (Global Offset Table) or return address

## Detection Strategy
Any `printf`-family call where the first argument (format string) comes from user input rather than a string literal.

## Remediation
Always use a literal format string with user data as a parameter argument.

**Vulnerable:**
```c
char buf[256];
fgets(buf, sizeof(buf), stdin);
printf(buf);  // Format string vulnerability!
```

**Safe:**
```c
char buf[256];
fgets(buf, sizeof(buf), stdin);
printf("%s", buf);  // User data as argument, not format string
```