I'm surprised that font exploits aren't more common. A few years ago I wrote a font fuzzer that would periodically crash the kernel, but I didn't do as much research as I would have liked.