How severe is non-constant format string with stream target?

Shield rates this high (CVSS 8.6), classified as CWE-134.

Rules / C/C++

SHIELD-CPP-007

Non-constant format string with stream target

highC/C++CWE-134CVSS 8.6

fprintf or sprintf using a variable as the format argument enables format string attacks.

Pass an explicit constant format string instead of a variable.

Vulnerable — Shield flags thiswarn.c

#include <stdio.h>

void warn(const char *msg) {
    fprintf(stderr, msg);
}

Fixed — scans cleanwarn.c

#include <stdio.h>

void warn(const char *msg) {
    fprintf(stderr, "%s", msg);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-007, the fixed one does not.