Format string vulnerabilities in programs can be found by:
-
Forcing buffer overflows
-
Submitting random long strings to the application
-
Causing underflow problems
-
Including string specifiers in input data
Format string vulnerabilities occur when user input is passed as the format argument to printf-style functions without proper validation. Attackers discover these flaws by embedding format specifiers like %x, %s, %n in their input and observing unexpected output or program behavior. If the application blindly uses the input as a format string, these specifiers leak memory contents or enable arbitrary writes. Buffer overflows (A) and underflows (C) are different vulnerability classes, while random long strings (B) might trigger crashes but won't specifically expose format string issues.
A format string vulnerability exists when user-supplied input is passed directly as (or into) a printf-family format argument instead of as plain data. To detect it, testers deliberately feed the application input containing format specifiers like %s, %x, or %n — if the program interprets them (crashing, leaking stack memory, or writing to memory), the vulnerability is confirmed. Simply sending long strings tests for buffer overflows, not format string bugs, since format string issues are about specifier interpretation, not length.