For a semester exam, which option is correct about format string bug?

Correct Answer: C

using attacker-controlled input as a format string, exposing or modifying memory

The correct answer is using attacker-controlled input as a format string, exposing or modifying memory.