diff --git a/lib/telnet.c b/lib/telnet.c
index d01ae25bb..64715b0dd 100644
--- a/lib/telnet.c
+++ b/lib/telnet.c
@@ -753,8 +753,7 @@ static int check_telnet_options(struct connectdata *conn)
      was given on the command line */
   if(conn->bits.user_passwd)
   {
-    char *buf = malloc(256);
-    sprintf(buf, "USER,%s", conn->user);
+    snprintf(option_arg, sizeof(option_arg), "USER,%s", conn->user);
     tn->telnet_vars = curl_slist_append(tn->telnet_vars, buf);
 
     tn->us_preferred[CURL_TELOPT_NEW_ENVIRON] = CURL_YES;