diff --git a/CHANGES b/CHANGES
index 42cde2dcf044870610b870d1f37c4a2955a064b5..5bd342a0657cf67c4620b19764b4bd589f1b7c52 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,7 @@ OpenLDAP 2.4.8 Engineering
 	Fixed libldap ldap_parse_sasl_bind_result (ITS#5263)
 	Fixed libldap search timeout crash (ITS#5291)
 	Fixed libldap paged results crash (ITS#5315)
+	Fixed libldap use of %n (ITS#5324)
 	Fixed ldapdelete with sizelimit (ITS#5294)
 	Fixed slapd idlcache on adds (ITS#5086)
 	Fixed slapd include handling (ITS#5276)
diff --git a/libraries/libldap/url.c b/libraries/libldap/url.c
index 4295895a5e6d00597712ec391685d017418c93d8..b614965dd05031de8801c1edbff271ea77923e91 100644
--- a/libraries/libldap/url.c
+++ b/libraries/libldap/url.c
@@ -642,14 +642,16 @@ desc2str( LDAPURLDesc *u, char *s, int len )
 	}
 
 	if ( u->lud_port ) {
-		len -= sprintf( s, "%s://%s%s%s:%d%n", u->lud_scheme,
+		sofar = sprintf( s, "%s://%s%s%s:%d", u->lud_scheme,
 				is_v6 ? "[" : "",
 				u->lud_host ? u->lud_host : "",
 				is_v6 ? "]" : "",
-				u->lud_port, &sofar );
+				u->lud_port );
+		len -= sofar;
 
 	} else {
-		len -= sprintf( s, "%s://%n", u->lud_scheme, &sofar );
+		sofar = sprintf( s, "%s://", u->lud_scheme );
+		len -= sofar;
 		if ( u->lud_host && u->lud_host[0] ) {
 			if ( is_v6 ) {
 				s[sofar++] = '[';