Multiple choice technology security

What is the vulnerability in this code? 

int main(int argc, char * argv[]) {   
    printf (argv[1]);  
}

  1. Buffer overflow

  2. Off by one error

  3. Format string vulnerability

  4. No vulnerabilities are present in this code
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The code directly prints argv[1] as the format string to printf. Since argv[1] comes from the command line (user input), an attacker can supply format specifiers like %x to read stack data or %n to write arbitrary values. This allows reading memory contents and potentially executing arbitrary code. Always use printf(%s, argv[1]) instead.

AI explanation

printf(argv[1]) passes attacker-controlled command-line input directly as the format string rather than as printf("%s", argv[1]). If argv[1] contains format specifiers like %x or %n, printf will interpret them, letting an attacker read stack values or write to arbitrary memory — the defining characteristic of a format string vulnerability.

Keep practicing — related questions