High CPU utilization of Kvoop with PDF documents in outlook

Article Id: 170281

Status: Published

Updated On: 07-02-2020 18:17

Legacy Id: TECH247823

Products:

Data Loss Prevention Endpoint Prevent

Issue/Introduction:

Kvoop.exe is taking 25-50 percent cpu when sending mail from Outlook with .pdf attached. Outlook stays in a not respond state for ten to fifteen minutes until the mail sends. Once the mail has sent kvoop.exe is no longer taking cpu.

Level: WARNING
Source: Detection.DataIdentifier.GlobalDataIdentifierMatcher
Message: Matcher State object not created

Cause:

This was caused by a corrupted .pdf file. When the .pdf file opened from other sources like Adobe Reader it seemed fine but when DLP scanned the file it would hang for long periods of time before sending the file.

Environment:

DLP 14.5

Resolution:

This issue has been addressed in current code (DLP 15).

The workaround is to recreate the .pdf from another source or not to use that .pdf file.