diff --git a/modules/access/cdda.c b/modules/access/cdda.c
index 2288fc02fc..0f5a2ece26 100644
--- a/modules/access/cdda.c
+++ b/modules/access/cdda.c
@@ -409,9 +409,9 @@ static char * BuildMusicbrainzDiscID( const vcddev_toc_t *p_toc,
 
     char buffer[16];
 
-    sprintf( buffer, "%02X", i_first );
+    snprintf( buffer, ARRAY_SIZE(buffer), "%02X", i_first );
     gcry_md_write( hd, buffer, 2 );
-    sprintf( buffer, "%02X", i_last );
+    snprintf( buffer, ARRAY_SIZE(buffer), "%02X", i_last );
     gcry_md_write( hd, buffer, 2 );
     /* LEAD OUT sector info */
 
@@ -423,12 +423,12 @@ static char * BuildMusicbrainzDiscID( const vcddev_toc_t *p_toc,
     else
         i_last_track_end = LBAPregap(p_toc->p_sectors[p_toc->i_tracks].i_lba);
 
-    sprintf( buffer, "%08X", i_last_track_end );
+    snprintf( buffer, ARRAY_SIZE(buffer), "%08X", i_last_track_end );
     gcry_md_write( hd, buffer, 8 );
 
     for( int i = 0; i<i_total; i++ ) /* skip LEAD OUT */
     {
-        sprintf( buffer, "%08X", LBAPregap(p_toc->p_sectors[i].i_lba) );
+        snprintf( buffer, ARRAY_SIZE(buffer), "%08X", LBAPregap(p_toc->p_sectors[i].i_lba) );
         gcry_md_write( hd, buffer, 8 );
     }