How severe is unbounded sprintf buffer overflow?

Shield rates this high (CVSS 8.1), classified as CWE-120.

Rules / C/C++

SHIELD-CPP-003

Unbounded sprintf buffer overflow

highC/C++CWE-120CVSS 8.1

sprintf writes formatted output without a size limit and can overflow the buffer.

Use snprintf or vsnprintf with an explicit buffer size.

Vulnerable — Shield flags thisformat.c

#include <stdio.h>

void log_user(const char *name, int id) {
    char line[64];
    sprintf(line, "user=%s id=%d", name, id);
}

Fixed — scans cleanformat.c

#include <stdio.h>

void log_user(const char *name, int id) {
    char line[64];
    snprintf(line, sizeof(line), "user=%s id=%d", name, id);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-003, the fixed one does not.