Uncontrolled format string
type of software vulnerability
Uncontrolled format string is a type of code injection vulnerability discovered around 1989 that can be used in security exploits. Originally thought harmless, format string exploits can be used to crash a program or to execute harmful code. The problem stems from the use of unchecked user input as the format string parameter in certain C functions that perform formatting, such as printf(). A malicious user may use the %s and %x format tokens, among others, to print data from the call stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token, which commands printf() and similar functions to write the number of bytes formatted to an address stored on the stack.
Details
A typical exploit uses a combination of these techniques to take control of the instruction pointer (IP) of a process, for example by forcing a program to overwrite the address of a library function or the return address on the stack with a pointer to some malicious shellcode. The padding parameters to format specifiers are used to control the number of bytes output and the %x token is used to pop bytes from the stack until the beginning of the format string itself is reached. The start of the format string is crafted to contain the address that the %n format token can then overwrite with the address of the malicious code to execute.
This is a common vulnerability because format bugs were previously thought harmless and resulted in vulnerabilities in many common tools. MITRE's CVE project lists roughly 500 vulnerable programs as of June 2007, and a trend analysis ranks it the 9th most-reported vulnerability type between 2001 and 2006.
Begin with the source’s own compact description: “Uncontrolled format string” is type of software vulnerability. The dossier treats that line as a proposition to test through Uncontrolled, format and string, not as a finished interpretation.
Why this record matters
The phrase “type of software vulnerability” supplies a clear boundary for inquiry. It also exposes the unanswered questions: who defined that boundary, when it became stable and which sources sit outside it.
Datasets, specimens, observations and peer-reviewed methods provide the appropriate test for the technical claims summarized here. The source revision retrieved here is dated Jun 22, 2026. The linked authority identifier is Q1133472. None of the 0 selected statements returned an explicit reference. The first chronological checks are 1989, 2007, 2001 and 2006.
Current terminology should not be projected backward without checking the classification used when the underlying evidence was created. The source lead contains qualifying language; that uncertainty should survive quotation, summary and reuse. Authority statements aid reconciliation but still require their own references, qualifiers and ranks to be checked.
How to read it
Check terminology, classification and the date of the cited evidence. Scientific names and technical consensus can change while older records retain historical value.
- Current terminology
- Classification context
- Finding cited technical literature
Primary datasets, specimen catalogues, standards bodies and the most recent peer-reviewed literature.
Three-step research path
- Establish the record: confirm the title “Uncontrolled format string”, its source revision and the description used here.
- Expand the search: follow Uncontrolled format string primary sources, Uncontrolled format string archive and Uncontrolled research across catalogues and specialist indexes.
- Test the account: compare the strongest cited source with the responsible institution’s current record and note any disagreement.
Questions for further research
- Which source most directly establishes the central claim about “Uncontrolled format string”?
- Is the terminology current, historical or disputed?
- Which observation, specimen, dataset or publication supports the account?
Search terms from this dossier
This entry incorporates text from “Uncontrolled format string” on English Wikipedia. Contributors are listed in the page history. Text is available under the Creative Commons Attribution-ShareAlike 4.0 License. Selected authority identifiers and statements are retrieved from Wikidata under CC0; their references and qualifiers remain part of the verification path.