Format string vulnerability, curl_msnprintf() function

A vulnerability has been identified in the curl library’s formatted output functions (specifically in curl_msnprintf and its related functions). When a malicious (attacker-controlled) format string containing the %hn conversion specifier is passed, the function incorrectly attempts to write the …

#include <stdio.h>
#include <curl/mprintf.h>

int main(void) {
    char buffer[256];
    const char *malicious_format = "%hnuked"; 
    printf("Using malicious format string: \"%s\"\n", malicious_format);
    curl_msnprintf(buffer, sizeof(buffer), malicious_format);
    printf("Formatted output: …