Crash in cfgrelayex, Analyzed 2 dumps, total processed 19, rate equals 10.53%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
0408e040 76a75fec gdi32full!pcfLocateCFONT+0x8
0408e3c0 76a72eea gdi32full!GetFontRealizationInfo+0xdc
0408e3f0 76a72c6e gdi32full!GdiRealizationInfo+0x2a
0408e4ac 76a71fbf gdi32full!GetFaceAndSizeMetrics+0x5e
0408e5b0 76a793b4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x35
0408e958 76a777b6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0408edc4 76a768df gdi32full!ScriptStringAnalyse+0xa16
0408ef44 76a76130 gdi32full!LpkCharsetDraw+0x60f
0408ef70 75de9f1d gdi32full!LpkDrawTextEx+0x30
0408efcc 75de9db4 user32!DT_DrawStr+0x5f
0408f02c 75de98eb user32!DT_GetLineBreak+0xa2
0408f0fc 75de96ee user32!DrawTextExWorker+0x1f9
0408f118 6ce8e8ba user32!DrawTextExW+0x1e
0408f17c 6ce8df54 uxtheme!CTextDraw::GetTextExtent+0xa4
0408f1c4 6ce84429 uxtheme!GetThemeTextExtent+0x74
0408f218 6ce91167 uxtheme!_GetNcCaptionTextSize+0x61
0408f30c 6ce92b1c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
0408f3b8 6ce92bcf uxtheme!_WindowPosChangedWorker+0x7c
0408f3c4 6ce8f735 uxtheme!OnOwpPostWindowPosChanged+0x1f
0408f414 75df4723 uxtheme!ThemePostWndProc+0x355
0408f4fc 75df42fa user32!UserCallWinProcCheckWow+0x363
0408f560 75dfb927 user32!DispatchClientMessage+0xea
0408f5a0 7756357d user32!__fnINLPWINDOWPOS+0x37
0408f5f0 6cead7bf ntdll!KiUserCallbackDispatcher+0x4d
0408f61c 6ce902cf uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0408f678 75df46cf uxtheme!ThemePreWndProc+0x43f
0408f760 75df2a2a user32!UserCallWinProcCheckWow+0x30f
0408f7d4 75df27f0 user32!DispatchMessageWorker+0x22a
0408f7e0 77faf5a1 user32!DispatchMessageW+0x10
0408f804 77faf2f7 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0408f864 77fb196f CfgRelayEx!CConfigCenterStub::Process+0xa7
0408f870 77fcffcb CfgRelayEx!CThread::ThreadProc+0x1f
0408f8ac 7553f989 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0408f8bc 77557084 kernel32!BaseThreadInitThunk+0x19
0408f918 77557054 ntdll!__RtlUserThreadStart+0x2f
0408f928 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
002ff654 77e8e0f3 ntdll!RtlpLowFragHeapFree+0xc5
002ff66c 77e94906 ntdll!RtlFreeHeap+0x105
002ff680 77e93e85 ntdll!RtlpFreeDebugInfo+0x3c
002ff6c0 54fac99f ntdll!RtlDeleteCriticalSection+0xd6
002ff6d8 54fa513d CfgRelayEx!__acrt_lowio_destroy_handle_array+0x22
002ff6e4 54fa81c5 CfgRelayEx!__acrt_uninitialize_lowio+0x15
002ff6fc 54fa12e7 CfgRelayEx!__acrt_execute_uninitializers+0x2f
002ff708 54f88fac CfgRelayEx!__acrt_uninitialize+0xf
002ff714 54f892fe CfgRelayEx!__scrt_uninitialize_crt+0x1a
002ff750 54f8918f CfgRelayEx!dllmain_crt_process_detach+0x60
002ff75c 54f893df CfgRelayEx!dllmain_crt_dispatch+0x4e
002ff79c 54f8947d CfgRelayEx!dllmain_dispatch+0xaf
002ff7b0 77e99280 CfgRelayEx!_DllMainCRTStartup+0x1c
002ff7d0 77eb8f88 ntdll!LdrpCallInitRoutine+0x14
002ff874 77eb8e2a ntdll!LdrShutdownProcess+0x1aa
002ff888 75627a3c ntdll!RtlExitUserProcess+0x74
002ff89c 0035275a kernel32!ExitProcessStub+0x12
002ff8a8 003526ef srvhost!exit_or_terminate_process+0x40
002ff8e0 00352895 srvhost!common_exit+0xee
002ff8f4 00347e90 srvhost!exit+0x11
002ff934 7562343d srvhost!__scrt_common_main_seh+0x179
002ff940 77e99812 kernel32!BaseThreadInitThunk+0xe
002ff980 77e997e5 ntdll!__RtlUserThreadStart+0x70
002ff998 00000000 ntdll!_RtlUserThreadStart+0x1b