Format string implementation vulnerability, resulting in code execution

In a security audit to the sprintf implementation in perl (version 5.24.1) I found a major security vulnerability, here are the full details. Timeline: ====== * 6th of May, 2017 - disclosure to the PERL security mailing list * 8th of May, 2017 - vulnerability confirmed by PERL's security group, …

print sprintf("%2000.2000f this is a spacer %4000.4294967245a", 1, 0x0.00008234p+9);