Windows Kernel win32k.sys TTF font processing suffers from a use-after-free in win32k!sbit_Embolden and win32k!ttfdCloseFontContext.