Format string: when %n writes to memory

October 11, 2025 · 1 min read · #binary-exploitation #format-string #memory

Passing user input as the format string is the bug: printf(buf) instead of printf("%s", buf). User %x/%p read values off the stack; %s dereferences; %n writes the number of bytes printed to the pointed address.

printf(buf);  // buf = "%p %p %p %p" dumps the stack
// "%n" writes -> arbitrary write primitive

The primitive

Combining positional access (%7$n) with count control (field width), you write an arbitrary value to an arbitrary address: overwrite a GOT entry or a return address.

Defence

The format string must always be a constant. Compilers warn (-Wformat-security); treat them as errors. %n is disabled in some hardened libcs and under FORTIFY.

« back to home