This was true maybe 10ish years ago ago but with ASLR, PAC, stack cookies and other mitigations it is now much harder to turn even a legitimate vulnerability (like a trivial buffer overflow) into actual RCE. Theres every likelihood that this isn't actually exploitable, on the other hand it might be, we will have to wait and see.

I get reads, but writes? How do you manage that? I'm presuming they're using the safe versions of sprintf but in case they're not, they probably have bigger problems.

I think printf has a %n specifier that writes the number of characters so far to a pointer passed in.