Variadic-function attacks and format-string attacks continue to threaten modern C/C++ software applications. When successfully executed, attackers are able to read, write, or execute arbitrary program memory. To address the problem of variadic-function attacks, this paper proposes Argument Width Counting (AWC), a new memory access-control policy that, when enforced, mitigates all observed variadic-function attacks, including format-string attacks, by tracking the initial size of variadic arguments on the stack and limiting requests to this number of bytes. A prototype for AWC has been implemented and evaluated on LLVM’s Clang C/C++ compiler and the accompanying libc++ standard library. The implementation modifies the compiler’s function-generation code to store variadic argument widths and to validate these values later when variadic arguments are accessed. The prototype’s performance overhead was tested and compared to existing solutions. The prototype incurs low overhead and outperforms the existing solutions. Microbenchmarking AWC returns around 22% overhead for 0–16 arguments. The overhead is less than 1% when benchmarked on real-world programs.