Adobe Acrobat and Reader: 83 records in one advisory
83 records announced together, published between 2019-05-22 and 2020-07-06, every one of them citing the same advisory.
The advisory
Every record in this batch cites https://helpx.adobe.com/security/products/acrobat/apsb19-41.html. That is the CNA's own reference, held in the index, and it is why these records are on one page.
What the records offer
No record in this batch publishes a fixed version in held sources.
No record in this batch is listed by CISA in held sources.
5 of 83 records name something of its own. For the other 78, held sources say the same thing about each.
Most commonly mapped weakness across the batch: Out-of-Bounds Read.
What this page does not cover
Every record citing this advisory is on this page.
The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.
What this batch was researched, not held
82 entries, 26 credit lines, and one identifier Adobe renumbered
APSB19-41 is Adobe's Acrobat and Reader update of 13 August 2019, at priority 2, covering the Continuous track at 2019.012.20035 and earlier along with the 2017 and 2015 classic tracks. Its table lists 82 identifiers and its acknowledgements credit every one of them, spread across 26 credit lines, with nothing attributed to Adobe's own testing. Almost all of it is memory safety: 25 out-of-bounds read entries, 25 use-after-free, 9 out-of-bounds write, 8 heap overflow, 5 type confusion, 3 untrusted pointer dereference, 2 integer overflow, and one each of command injection, buffer error, double free, internal address disclosure and weak encryption. Four reporters carry most of the load. Ke Liu of Tencent Security Xuanwu Lab has 12, Mateusz Jurczyk of Google Project Zero has 12, Mat Powell of Trend Micro Zero Day Initiative has 8, and Steven Seeley of Source Incite has 15 across three credit lines, one direct and two through brokers. Adobe then edited the bulletin six times into December 2019, and one of those edits was not an addition.
These came from roughly two dozen unrelated reporters and were shipped on one day, so the record you are reading stands on its own. One oddity explains a duplicate you may meet: Adobe renumbered CVE-2019-7832 to CVE-2019-8066 on 22 August 2019, and both identifiers still circulate for the same issue.
Adobe gives a bug class and an impact for each entry and stops there, so two entries in the same class are indistinguishable in the record. There is no affected file, no trigger and no report date anywhere in the bulletin. It also does not say whether any of the 82 reports were duplicates of one another, which matters here because three separate credit lines carry the same researcher's handle.
Written from web.archive.org, helpx.adobe.com, rapid7.com. Reviewed for whether every claim traces to one of them, by two independent graders, citation support 4.44 of 5, uniqueness 4 of 5. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.
Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.
83 records, read from the index as it stood on 2026-09-20. Every row opens the record it names, and every value on that record opens its own receipt.