Pretty much all of GDI used to be in the kernel, the font stuff is one of the major parts still remaining, although the article says that Microsoft is moving it

Pretty much all of GDI used to be in the kernel, the font stuff is one of the major parts still remaining, although the article says that Microsoft is moving it out as of Windows 10. A few years ago there was a remote code execution exploit that had to do with decoding EMF/WMF images in the kernel: https://www.symantec.com/security_response/vulnerability.jsp?bid=34012 https://www.symantec.com/security_response/vulnerability.jsp... I believe that one got at least partially fixed by moving some of the video code out of the kernel and into user-mode with Vista, but I don't recall exactly.