How to get control of rip with formatstring vulnerability, if the buffer is not on the stack (C)

Question

I wonder how and if it is possible to get rip control with formatstring exploit in C, even though the buffer isn\'t on the stack. Is it possible? If yes, can someone explain