What is the vulnerability in this code?

    char output[20];  
    /*   Assume data is a character array with value %200d asdf   */  
    sprintf(output, data);