Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution
Given that the font hinting system is turing complete, and that font ligature substitution is a bizarre regular expression system [2], my only surprise is that we haven't found more holes in font renderers.  Given many of the features aren't used in regular fonts, maybe it's time we pared down font rendering to something a bit more sensible.[2] http://ansuz.sooke.bc.ca/entry/131