Windows Uniscribe heap-based out-of-bounds read in USP10!ScriptApplyLogicalWidth（CVE-2017-0062）

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!ScriptApplyLogicalWidth function, while trying to display a malformed EMF file: 920c.9190: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handling. This...