Microsoft Windows Uniscribe heap-based out-of-bounds read in USP10!ScriptApplyLogicalWidth, trigger via EMF. Continue reading...