Adobe Acrobat Reader: 25 records in one advisory
25 records announced together, published between 2021-09-29 and 2023-09-06, every one of them citing the same advisory.
The advisory
Every record in this batch cites https://helpx.adobe.com/security/products/acrobat/apsb21-55.html. That is the CNA's own reference, held in the index, and it is why these records are on one page.
What the records offer
No record in this batch publishes a fixed version in held sources.
No record in this batch is listed by CISA in held sources.
13 of 25 records name something of its own. For the other 12, held sources say the same thing about each.
Most commonly mapped weakness across the batch: CWE-416 Use After Free (CWE-416).
What this page does not cover
This batch is 25 of the 28 records that cite the same advisory. The other 3 are different findings announced alongside it.
None of those 3 is grouped with any other. Each one has its own record page and nothing else.
The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.
What this batch was researched, not held
One fix in this Adobe update existed only because the June fix locked the wrong fields
APSB21-55 is Adobe's Acrobat and Reader update of 14 September 2021, for Acrobat and Reader DC at 2021.005.20060 and earlier, the 2020 track at 2020.004.30006 and earlier and the 2017 track at 2017.011.30199 and earlier. One of its entries has a public account of where it came from, and it is not an independent discovery. Writing for Trend Micro's Zero Day Initiative in October 2021, Mark Vincent Yason explained that he had found an earlier bug, CVE-2021-28632, by fuzzing. It was a use-after-free in the C++ objects that represent interactive form fields inside Adobe's AcroForm module, where locking a field failed to lock the fields beneath it, so a callback could free a child that was still in use. Adobe fixed that one in June 2021 by adding a call that locks the field's immediate descendants. Yason read the patch, noticed it locked only one level down, and reached the same bug through a grandchild field. That bypass is CVE-2021-39840, which Adobe fixed here in September. Of the 27 identifiers whose public records point at this bulletin, the two largest groups are 8 use-after-free and 7 null pointer dereference, with 4 out-of-bounds read, 3 out-of-bounds write and 3 information exposure behind them.
These identifiers were announced on one day by one vendor and came from several unrelated reporters, so the record you are reading is separate from the rest even where two sit in the same part of the code. The one exception is documented by the researcher himself: CVE-2021-39840 exists because the earlier fix for CVE-2021-28632 was incomplete, so having installed the June 2021 update did not cover it.
Adobe gives no report date, no affected function and no reproduction for any entry, so the gap between discovery and the 14 September announcement is unknown, and the bulletin says nothing about whether any of these were used in attacks. Only the one Yason wrote up publicly has a known root cause; for the rest the public record gives a weakness class and no code.
Written from thezdi.com, services.nvd.nist.gov, helpx.adobe.com. Reviewed for whether every claim traces to one of them, by two independent graders, citation support 4.44 of 5, uniqueness 4 of 5. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.
Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.
25 records, read from the index as it stood on 2026-09-20. Every row opens the record it names, and every value on that record opens its own receipt.