diff --git a/ChangeLog b/ChangeLog
index fa9394d6b3..ef10db070b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2016-09-02  Florian Weimer  <fweimer@redhat.com>
+
+	* stdio-common/vfprintf.c (process_string_arg): Use MB_LEN_MAX
+	instead of MB_CUR_MAX to avoid variable-length array.
+
 2016-09-01  Paul E. Murphy  <murphyp@linux.vnet.ibm.com>
 
 	* math/Makefile (libm-calls): Remove k_rem_pio2F.
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 6e428e9044..13ab47a4c2 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1082,7 +1082,7 @@ static const uint8_t jump_table[] =
     LABEL (form_wcharacter):						      \
       {									      \
 	/* Wide character.  */						      \
-	char buf[MB_CUR_MAX];						      \
+	char buf[MB_LEN_MAX];						      \
 	mbstate_t mbstate;						      \
 	size_t len;							      \
 									      \