CVE-2014-0993

Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

• CWE-119

• http://support.embarcadero.com/article/44015Patch, Vendor Advisory
• http://www.coresecurity.com/advisories/delphi-and-c-builder-vcl-library-buffer-overflow
• http://www.kb.cert.org/vuls/id/646748Third Party Advisory, US Government Resource
• http://support.embarcadero.com/article/44015Patch, Vendor Advisory
• http://www.coresecurity.com/advisories/delphi-and-c-builder-vcl-library-buffer-overflow
• http://www.kb.cert.org/vuls/id/646748Third Party Advisory, US Government Resource

Published

Sep 15, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0987Stack-based buffer overflow in Advantech WebAccess (formerly…
• CVE-2014-0988Stack-based buffer overflow in Advantech WebAccess (formerly…
• CVE-2014-0989Stack-based buffer overflow in Advantech WebAccess (formerly…
• CVE-2014-0990Stack-based buffer overflow in Advantech WebAccess (formerly…
• CVE-2014-0991Stack-based buffer overflow in Advantech WebAccess (formerly…
• CVE-2014-0992Stack-based buffer overflow in Advantech WebAccess (formerly…
• CVE-2014-0994Heap-based buffer overflow in the ReadDIB function in the Vc…
• CVE-2014-0995The Standalone Enqueue Server in SAP Netweaver 7.20, 7.01, a…
• CVE-2014-0997WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, A…
• CVE-2014-0998Integer signedness error in the vt console driver (formerly …
• CVE-2014-0999Sendio before 7.2.4 includes the session identifier in URLs …
• CVE-2014-10000Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…