Microsoft Windows - 'win32k.sys' TTF Processing RCVT TrueType Instruction Handler Out-of-Bounds Read (MS16-120)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=864 We have encountered a number of Windows kernel crashes in the win32k!itrpGetCVTEntryFast function called by the handler of the RCVT TrueType instruction while processing corrupted TTF font files, such as: ---...