A format-string bug believed to be a low-risk denial-of-service issue turns out to be much nastier than expected.
Source: Threadpost