diff --git a/thirdparty/vschannel/vschannel.c b/thirdparty/vschannel/vschannel.c
index 34126d6b6e..0d55dde7e8 100644
--- a/thirdparty/vschannel/vschannel.c
+++ b/thirdparty/vschannel/vschannel.c
@@ -757,7 +757,7 @@ static SECURITY_STATUS https_make_request(TlsContext *tls_ctx, CHAR *req, CHAR *
 
 	// Build HTTP request. Note that I'm assuming that this is less than
 	// the maximum message size. If it weren't, it would have to be broken up.
-	sprintf(pbMessage,  req);
+	sprintf(pbMessage, "%s", req);
 
 	cbMessage = (DWORD)strlen(pbMessage);