diff --git a/dlls/msvcrt/errno.c b/dlls/msvcrt/errno.c
index a80ac61f118..0497e59739d 100644
--- a/dlls/msvcrt/errno.c
+++ b/dlls/msvcrt/errno.c
@@ -323,9 +323,9 @@ char* CDECL MSVCRT__strerror(const char* str)
     if (err < 0 || err > MSVCRT__sys_nerr) err = MSVCRT__sys_nerr;
 
     if (str && *str)
-        sprintf( data->strerror_buffer, "%s: %s\n", str, MSVCRT__sys_errlist[err] );
+        MSVCRT_sprintf( data->strerror_buffer, "%s: %s\n", str, MSVCRT__sys_errlist[err] );
     else
-        sprintf( data->strerror_buffer, "%s\n", MSVCRT__sys_errlist[err] );
+        MSVCRT_sprintf( data->strerror_buffer, "%s\n", MSVCRT__sys_errlist[err] );
 
     return data->strerror_buffer;
 }
diff --git a/dlls/msvcrt/exit.c b/dlls/msvcrt/exit.c
index b357b83b33c..f631d4d727b 100644
--- a/dlls/msvcrt/exit.c
+++ b/dlls/msvcrt/exit.c
@@ -237,7 +237,7 @@ void CDECL _amsg_exit(int errnum)
      ((MSVCRT_error_mode == MSVCRT__OUT_TO_DEFAULT) && (MSVCRT_app_type == 2)))
   {
     char text[32];
-    sprintf(text, "Error: R60%d",errnum);
+    MSVCRT_sprintf(text, "Error: R60%d",errnum);
     DoMessageBox("Runtime error!", text);
   }
   else
diff --git a/dlls/msvcrt/locale.c b/dlls/msvcrt/locale.c
index 72a52a20a90..bbcaed0ae08 100644
--- a/dlls/msvcrt/locale.c
+++ b/dlls/msvcrt/locale.c
@@ -454,7 +454,7 @@ static BOOL update_threadlocinfo_category(LCID lcid, unsigned short cp,
         len += GetLocaleInfoA(lcid, LOCALE_SENGCOUNTRY
                 |LOCALE_NOUSEROVERRIDE, &buf[len], 256-len);
         buf[len-1] = '.';
-        sprintf(buf+len, "%d", cp);
+        MSVCRT_sprintf(buf+len, "%d", cp);
         len += strlen(buf+len);
 
         return init_category_name(buf, len, locinfo, category);
@@ -507,7 +507,7 @@ static inline char* construct_lc_all(MSVCRT_pthreadlocinfo locinfo) {
     if(i==MSVCRT_LC_MAX)
         return locinfo->lc_category[MSVCRT_LC_COLLATE].locale;
 
-    sprintf(current_lc_all,
+    MSVCRT_sprintf(current_lc_all,
             "LC_COLLATE=%s;LC_CTYPE=%s;LC_MONETARY=%s;LC_NUMERIC=%s;LC_TIME=%s",
             locinfo->lc_category[MSVCRT_LC_COLLATE].locale,
             locinfo->lc_category[MSVCRT_LC_CTYPE].locale,
diff --git a/dlls/msvcrt/math.c b/dlls/msvcrt/math.c
index 19a4da222b3..eae917076ff 100644
--- a/dlls/msvcrt/math.c
+++ b/dlls/msvcrt/math.c
@@ -1735,7 +1735,7 @@ char * CDECL MSVCRT__ecvt( double number, int ndigits, int *decpt, int *sign )
     /* handle cases with zero ndigits or less */
     prec = ndigits;
     if( prec < 1) prec = 2;
-    len = snprintf(data->efcvt_buffer, 80, "%.*le", prec - 1, number);
+    len = MSVCRT__snprintf(data->efcvt_buffer, 80, "%.*le", prec - 1, number);
     /* take the decimal "point away */
     if( prec != 1)
         memmove( data->efcvt_buffer + 1, data->efcvt_buffer + 2, len - 1 );
@@ -1795,7 +1795,7 @@ int CDECL MSVCRT__ecvt_s( char *buffer, MSVCRT_size_t length, double number, int
         number = -number;
     } else
         *sign = FALSE;
-    len = snprintf(result, prec + 7, "%.*le", prec - 1, number);
+    len = MSVCRT__snprintf(result, prec + 7, "%.*le", prec - 1, number);
     /* take the decimal "point away */
     if( prec != 1)
         memmove( result + 1, result + 2, len - 1 );
@@ -1837,7 +1837,7 @@ char * CDECL MSVCRT__fcvt( double number, int ndigits, int *decpt, int *sign )
 	number = -number;
     } else *sign = 0;
 
-    stop = snprintf(buf, 80, "%.*f", ndigits < 0 ? 0 : ndigits, number);
+    stop = MSVCRT__snprintf(buf, 80, "%.*f", ndigits < 0 ? 0 : ndigits, number);
     ptr1 = buf;
     ptr2 = data->efcvt_buffer;
     first = NULL;
@@ -1920,7 +1920,7 @@ int CDECL MSVCRT__fcvt_s(char* outbuffer, MSVCRT_size_t size, double number, int
 	number = -number;
     } else *sign = 0;
 
-    stop = snprintf(buf, 80, "%.*f", ndigits < 0 ? 0 : ndigits, number);
+    stop = MSVCRT__snprintf(buf, 80, "%.*f", ndigits < 0 ? 0 : ndigits, number);
     ptr1 = buf;
     ptr2 = outbuffer;
     first = NULL;
diff --git a/dlls/msvcrt/mbcs.c b/dlls/msvcrt/mbcs.c
index 39f94b17a36..5215eff0e3c 100644
--- a/dlls/msvcrt/mbcs.c
+++ b/dlls/msvcrt/mbcs.c
@@ -239,7 +239,7 @@ int _setmbcp_l(int cp, LCID lcid, MSVCRT_pthreadmbcinfo mbcinfo)
   }
 
   if(lcid == -1) {
-    sprintf(bufA, format, newcp);
+    MSVCRT_sprintf(bufA, format, newcp);
     mbcinfo->mblcid = MSVCRT_locale_to_LCID(bufA, NULL, NULL);
   } else {
     mbcinfo->mblcid = lcid;
diff --git a/dlls/msvcrt/msvcrt.h b/dlls/msvcrt/msvcrt.h
index a45b82a944c..3ffc785d065 100644
--- a/dlls/msvcrt/msvcrt.h
+++ b/dlls/msvcrt/msvcrt.h
@@ -1191,6 +1191,7 @@ int __cdecl      MSVCRT_strcmp(const char*, const char*);
 char* __cdecl    MSVCRT_strstr(const char*, const char*);
 unsigned int __cdecl MSVCRT__get_output_format(void);
 char* __cdecl MSVCRT_strtok_s(char*, const char*, char**);
+char* __cdecl MSVCRT__itoa(int, char*, int);
 double parse_double(MSVCRT_wchar_t (*)(void*), void (*)(void*), void*, MSVCRT_pthreadlocinfo, int*);
 
 /* Maybe one day we'll enable the invalid parameter handlers with the full set of information (msvcrXXd)
diff --git a/dlls/msvcrt/printf.h b/dlls/msvcrt/printf.h
index d7f3b6f2251..a5a2f5c4a18 100644
--- a/dlls/msvcrt/printf.h
+++ b/dlls/msvcrt/printf.h
@@ -282,7 +282,9 @@ static inline void FUNC_NAME(pf_rebuild_format_string)(char *p, FUNC_NAME(pf_fla
     if(flags->Alternate)
         *p++ = flags->Alternate;
     if(flags->Precision >= 0) {
-        p += sprintf(p, ".%d", flags->Precision);
+        *p++ = '.';
+        MSVCRT__itoa(flags->Precision, p, 10);
+        p += strlen(p);
     }
     *p++ = flags->Format;
     *p++ = 0;
@@ -663,11 +665,11 @@ int FUNC_NAME(pf_printf)(FUNC_NAME(puts_clbk) pf_puts, void *puts_ctx, const API
                 static const char ind_str[] = "nan(ind)";
                 static const char nan_str[] = "nan";
                 if(inf)
-                    sprintf(tmp, inf_str);
+                    memcpy(tmp, inf_str, ARRAY_SIZE(inf_str));
                 else if(ind)
-                    sprintf(tmp, ind_str);
+                    memcpy(tmp, ind_str, ARRAY_SIZE(ind_str));
                 else
-                    sprintf(tmp, nan_str);
+                    memcpy(tmp, nan_str, ARRAY_SIZE(nan_str));
                 if (strchr("EFG", flags.Format))
                     for(i=0; tmp[i]; i++)
                         tmp[i] = MSVCRT__toupper_l(tmp[i], NULL);
diff --git a/dlls/msvcrt/string.c b/dlls/msvcrt/string.c
index 7baf8eee8e8..1e3e0d15bf7 100644
--- a/dlls/msvcrt/string.c
+++ b/dlls/msvcrt/string.c
@@ -2301,8 +2301,8 @@ int CDECL MSVCRT_I10_OUTPUT(MSVCRT__LDOUBLE ld80, int prec, int flag, struct _I1
         prec = 0;
     }
 
-    sprintf(format, "%%.%dle", prec);
-    sprintf(buf, format, d);
+    MSVCRT_sprintf(format, "%%.%dle", prec);
+    MSVCRT_sprintf(buf, format, d);
 
     buf[1] = buf[0];
     data->pos = atoi(buf+prec+3);
diff --git a/dlls/msvcrt/undname.c b/dlls/msvcrt/undname.c
index df3e4e8cc80..69eef44654e 100644
--- a/dlls/msvcrt/undname.c
+++ b/dlls/msvcrt/undname.c
@@ -331,7 +331,7 @@ static const char* get_number(struct parsed_symbol* sym)
         if (*sym->current != '@') return NULL;
 
         ptr = und_alloc(sym, 17);
-        sprintf(ptr, "%s%u", sgn ? "-" : "", ret);
+        MSVCRT_sprintf(ptr, "%s%u", sgn ? "-" : "", ret);
         sym->current++;
     }
     else return NULL;