Why This Is Such a Strong Primitive

A single format string bug typically yields:

• Arbitrary read (%s) —- dump canary, libc, PIE base, any memory you can point at.
• Arbitrary write (%n) —- change any writable word: GOT, saved RIP, function pointers, loop counters, flags.
• Repeatable: many programs loop, letting you leak then write in separate passes with known addresses.

Read + write + repeatable = effectively full control of the process, often

without needing a memory-corruption overflow at all.