Heap corruption via unbounded formatted string copy

Buffer overflow in Matplotlib allows attackers to corrupt heap memory through an oversized font path passed to an exposed API. The Printf::Printf constructor in src/mplutils.cpp sends attacker-influenced formatted data to vsprintf, which writes past a fixed 1,024-byte buffer without a length limit. Reachability requires Python execution or an application path that accepts an attacker-controlled font string; the published reproducer corrupts the Python process heap and terminates it.