Which statement best describes the purpose of format string bug?

A. using attacker-controlled input as a format string, exposing or modifying memory B. changing time zone C. compressing a file D. using prepared statements