High CPU utilization of Kvoop with PDF documents in outlook

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

Kvoop.exe is taking 25-50 percent cpu when sending mail from Outlook with .pdf attached. Outlook stays in a not respond state for ten to fifteen minutes until the mail sends. Once the mail has sent kvoop.exe is no longer taking cpu.

Level: WARNING
Source: Detection.DataIdentifier.GlobalDataIdentifierMatcher
Message: Matcher State object not created

Cause

This was caused by a corrupted .pdf file. When the .pdf file opened from other sources like Adobe Reader it seemed fine but when DLP scanned the file it would hang for long periods of time before sending the file.

Environment

DLP 14.5

Resolution

This issue has been addressed in current code (DLP 15). 

The workaround is to recreate the .pdf from another source or not to use that .pdf file.