From reading the description, I get the feeling that this is nowhere near as severe as e.g. Heartbleed, right?<p>IMHO dynamic allocation is something that is often overused, and the fact that it could fail leads to another error path that might be exploitable, like this one. I don&#x27;t think it&#x27;s necessary for a printf-like function to <i>ever</i> use dynamic allocation. (If there are cases where it&#x27;s necessary, I would love to know more... and perhaps suggest how it could be avoided.)