AIKIDO-2026-360852
fmtlib.fmt is vulnerable to Out-of-bounds Read
59
Medium Risk
This Affects:
fmtlib.fmtTL;DR
The printf-style formatting entry points fmt::printf and fmt::sprintf parse the format string and its positional arguments without adequate bounds checks. A malformed format string causes the parser to read past the end of the format string or before the argument array. Before the fix these produced out-of-bounds reads of uninitialized or adjacent memory that can disclose process data or crash the program. The fix adds index and length validation and stops assuming null termination of the format string.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted format strings or argument sequences to fmt::printf or fmt::sprintf.
Background info
fmtlib.fmt is vulnerable to Out-of-bounds Read in versions 6.0.0 - 12.1.0.
How to fix this
Upgrade the fmtlib.fmt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant