An issue exists when calling the wide scanf family of functions (`swscanf()`, `fwscanf()`, `wscanf()`, `vswscanf()`, `vfwscanf()`, and `vwscanf()`) using a `%s` or `%[` conversion without the `l` length modifier. When a converted multibyte string and its terminating null byte exactly fill the destination array, the functions write an additional null byte one byte past the end of the array. This out-of-bounds write can lead to adjacent data corruption or process crashes. The issue affects all supported architectures and ABIs.