Buffer overflow? No problem

I used to work with printf() function for decades. And I've proved that I'm experienced guy in it. It was harder for me to catch buffer overflow, than to find memory leaks.

std::string Format( Data & data )
{
   std::string res;
   char buf[256];
   sprintf(buf, "[%s] %s", data.GetSeverity(), data.descr.c_str());
   res = buf;
   res.append("\n");
  
   return res;
}

The problem that data.descr COULD be > 256 bytes length...