The Microsoft Windows kernel pool address is leaked via an undocumented GetFontData feature in ATMFD. Continue reading...