Stack Canary Bypass via Format String Leak
Leaking the stack canary through a format-string information disclosure, then overwriting the return address while keeping the canary intact.
2022-03-14$ grep -r category=Stack Canary
1 writeup in this category.