Comment by geofft

I believe TrueType fonts are still rendered in kernel mode. (They have a policy option for blocking untrusted fonts, because of course that parser has bugs.)