After upgrading to Symantec Mail Security for Microsoft Exchange (SMSMSE) 7.5.5, some properly formed PDF files are deemed malformed and the action configured in the SMSMSE console under Policies -> Exceptions -> UFR- Malformed files is taken.
In the application event log, an event id 218 is logged from source "Symantec Mail Security for Microsoft Exchange" with the following details:
The message "<message subject>" located in <message location> has violated the following policy settings:
Rule: UFR - Malformed Files
The following actions were taken on it:
The message "<message subject>" was <action>:
Scan Engine Error. CSAPI DEC result: 0xA. A malformed container is detected. Engine Name: PDF.
For more information, visit https://entced.symantec.com/entt?product=SMSMSE&build=symantec_ent&version=18.104.22.168&language=english&module=event_logging&error=218 .
A problem in the component that breaks files down to their component parts for scanning (Decomposer engine) causes files to be misidentified as Malformed despite containing all the proper elements.
Symantec is aware of this issue and will update this article when a permenant solution is available. Please subscribe to this article to be informed when an update that addresses this issue is available.