Adobe Acrobat Reader: 34 records in one advisory

What this batch was researched, not held

Two annotation findings from the same researcher, reported two weeks apart

This group holds 34 of the 74 records naming Adobe's May 2022 Acrobat and Reader update, all published on 11 May 2022. Two of them can be followed all the way back, because Trend Micro's Zero Day Initiative published its own advisories for them. CVE-2022-28268 is a read past the end of a buffer in the handling of annotation objects, the parts of a document that hold comments, highlights and stamps. CVE-2022-28250 is a use-after-free in the parsing of the same kind of object, where the program acts on an object without first checking it is still there. Both were reported by Mat Powell of the Zero Day Initiative, on 25 February 2022 and 11 March 2022, two weeks apart and into the same area of the program. The Zero Day Initiative published both on 28 April 2022 and both advisories point back to this Adobe update as the fix. Both are rated 3.3 out of 10, which is low: on their own they leak a little memory, and the advisories say an attacker would need to combine one with something else to run code.

These records were published on one day because Adobe ships Reader fixes on a schedule, not because they are one problem. For two of them we can name the researcher, the date he reported it and the part of the program involved. For the other 32 we cannot, and nothing in a record says whether it resembles the two we can.

The specific gap here is attribution, not description. Adobe's acknowledgements page is not readable to us, so of the 34 records in this group we can name a reporter for two, and only because the Zero Day Initiative published those two itself. Nothing tells you how the other 32 were found, when they were reported, or whether they came from one person or thirty. Nothing here says whether any of them was ever seen in an attack.

Written from zerodayinitiative.com, zerodayinitiative.com, cveawg.mitre.org, cveawg.mitre.org, helpx.adobe.com. Reviewed for whether every claim traces to one of them, by two independent graders, citation support 4.44 of 5, uniqueness 4 of 5. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.