What is CVE-2014-0994?

CVE-2014-0994 is a vulnerability in Embarcadero C\+\+builder Xe6, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-10-06.

Is CVE-2014-0994 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Embarcadero C\+\+builder Xe6

CVE-2014-0994

Heap-based buffer overflow in the ReadDIB function in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows context-dependent attackers to execute arbitrary code via the BITMAPINFOHEADER.biClrUsed field in a BMP file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0993.

Vulnerability class: Buffer Overflow

EPSS: 0.028 (84.8th percentile) — read the EPSS interpretation.

Affected products

Embarcadero Embarcadero_c\+\+builder_xe6 — versions 20.0.15596.9843
Embarcadero Embarcadero_delphi_xe6 — versions 20.0.15596.9843
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

helpsystems/Embarcadero-Workaround

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_FULLDISC)
cve@mitre.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2014-0994?: CVE-2014-0994 is a vulnerability in Embarcadero C\+\+builder Xe6, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2014-10-06.
Is CVE-2014-0994 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.