More than one Turing Complete VM inside the font renderer stack, at that. One of the biggest recurring CVE generators in both Windows and Macintosh was 1984's legacy of the Adobe Type 1 font format [1]. Everyone had to license it for backward compatibility with PostScript documents. It shared enough Turing completeness with PostScript despite being a subset.

Both Windows and Macintosh spent years trying to isolate type rendering from kernel operations specifically because of Adobe Type 1's legacy alone, including the fact that it was an ugly vendored 3rd party spaghetti. IIRC, both Apple and Microsoft ended up paying Adobe tons of money to rewrite their Type 1 Font Manager code from scratch rather than keep paying Adobe to write that code. (TTF and OpenType were also both somewhat direct responses to Type 1's legacy and mistakes.)

[1] https://en.wikipedia.org/wiki/PostScript_fonts

Microsoft began the push to move TTF rendering out of the kernel in Vista. I'm sure there are still bits here-and-there that are still kernel.

as an aside- I find the fact even microsoft's own modal dialogs don't all support DPI scaling- aka they are blurry.