This is a kernel-mode vulnerability that takes advantage of the fact that Microsoft’s font controls are at the kernel. Fonts are often cited as a vector for vulnerabilities due to the need for elevated privileges to display them. Not sure I understand the mechanism well enough, but I don’t think it’s buffer overflow. I’ve been wrong before.
It’s also worthwhile to note this is related to OpenType fonts, which are very popular in web design, as I understand it.
Something is causing the driver to go looey... you’d think that part of the kernel would be armor plated against this kind of roto rooter. Data that goes one inch beyond what it should will be cut off. Still thinking buffer overflow, that is Occam’s Razor view of the problem.