How Common Was It?

• Extremely common in late-1990s / early-2000s C code.
• Any function taking a format: printf, fprintf, sprintf, snprintf, syslog, err/warn, vprintf, scanf (%n on writes).
• Classic real bugs: wu-ftpd, proftpd, screen, and many syslog(msg) calls where msg was attacker-controlled.
• Still appears today whenever a logging or error path forwards user text straight into a format parameter.