CVE-2016-4819

Vulnerability

A double format string processing vulnerability exists in the printfDx function of the DX Library for Borland C++, Gnu C++, and Visual C++ (versions Ver3.13f through Ver3.16b). When printfDx is called with a format string argument, it performs two successive format string expansions. For example, printfDx("%s", "%d") first replaces "%s" with "%d", then attempts to expand the "%d" with an integer value. Additionally, in the same version range, functions like DrawFormatString and printfDx that accept format strings suffer from a buffer overflow when format specifiers %f or %e generate strings longer than 1023 characters (e.g., %.1500f or %.2000e). The double processing bug makes it possible for a user-supplied string to be interpreted as a format string, triggering the overflow [1], [2].

Exploitation

An attacker must supply a carefully crafted string containing format specifiers (notably %e) as a format-string argument to an affected function. The first round of format processing replaces the attacker's placeholder with another format specifier, and the second round expands that specifier, causing a buffer overflow. The attacker does not need prior authentication or local access; the attack surface is any application that passes user-supplied strings to printfDx or similar functions. The attack complexity is high because the crafted string must be precisely tuned to achieve predictable memory corruption [1], [2].

Impact

Successful exploitation allows remote arbitrary code execution in the context of the application using the vulnerable DX Library. The confidentiality, integrity, and availability impacts are all high, as the attacker can execute arbitrary instructions, modify application state, or read sensitive data [1], [2], [3].

Mitigation

The vendor recommends updating the DX Library to the latest version (Ver3.24f as of March 2025) and rebuilding any application that uses the library. For users of the affected versions (Ver3.13f through Ver3.16b), no workaround is provided other than upgrading to a version that is not affected. The latest version has no known vulnerabilities [1], [2], [3].