Comment by ryuuchin

Although the rendering may still be done in kernel mode the parsing is now done in a usermode sandbox[1] which significantly reduces risks from handling untrusted fonts.

[1] https://blogs.technet.microsoft.com/secguide/2017/06/15/drop...