Background: A %n format specifier in a printf call stores the number of characters written so far into a specified variable. For example:

    #include <stdio.h>
    int main(void) {
        int count;
        printf("%s%n\n", "hello, world", &count);
        printf("count = %d\n", count);
    }

The output is:

    hello, world
    count = 12

%n can be exploited to write data to an arbitrary memory location, but only if the format string is something other than a string literal.

%n can be exploited, but it's entirely possible to use it safely.