Crash in cfgrelayex, Analyzed 2 dumps, total processed 114, rate equals 1.75%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
0466e2d8 76823f6f gdi32full!GetFontRealizationInfo+0x15
0466e888 76824d9c gdi32full!LoadFont+0x76
0466e8ac 76825893 gdi32full!FindOrCreateFaceCache+0x98
0466e9b0 7682d1a4 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
0466ed58 7682b5a6 gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
0466f1c4 7682a68f gdi32full!ScriptStringAnalyse+0xa16
0466f344 76829ee0 gdi32full!LpkCharsetDraw+0x60f
0466f370 7665d4fd gdi32full!LpkDrawTextEx+0x30
0466f3cc 7665d394 user32!DT_DrawStr+0x5f
0466f42c 7665cecb user32!DT_GetLineBreak+0xa2
0466f4fc 7665ccce user32!DrawTextExWorker+0x1f9
0466f518 64e6e6ca user32!DrawTextExW+0x1e
0466f57c 64e6dd34 uxtheme!CTextDraw::GetTextExtent+0xa4
0466f5c4 64e643c9 uxtheme!GetThemeTextExtent+0x74
0466f618 64e70f87 uxtheme!_GetNcCaptionTextSize+0x61
0466f708 64e7293c uxtheme!CThemeWnd::GetNcWindowMetrics+0x307
0466f7b4 64e729ef uxtheme!_WindowPosChangedWorker+0x7c
0466f7c0 64e6f545 uxtheme!OnOwpPostWindowPosChanged+0x1f
0466f810 76667f43 uxtheme!ThemePostWndProc+0x355
0466f8fc 76667b30 user32!UserCallWinProcCheckWow+0x363
0466f960 7666f897 user32!DispatchClientMessage+0x190
0466f9a0 779a56cd user32!__fnINLPWINDOWPOS+0x37
0466f9f0 76ad124c ntdll!KiUserCallbackDispatcher+0x4d
0466f9f4 64e8d44f win32u!NtUserSetWindowPos+0xc
0466fa20 64e700ef uxtheme!OnOwpPreDwmCompositionChanged+0x4f
0466fa7c 76667eef uxtheme!ThemePreWndProc+0x43f
0466fb68 766667c0 user32!UserCallWinProcCheckWow+0x30f
0466fbe4 766662f0 user32!DispatchMessageWorker+0x4c0
0466fbf0 612e24f1 user32!DispatchMessageW+0x10
0466fc14 612e2247 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
0466fc74 612e48bf CfgRelayEx!CConfigCenterStub::Process+0xa7
0466fc80 6130b53b CfgRelayEx!CThread::ThreadProc+0x1f
0466fcbc 7749fcc9 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0466fccc 779982ae kernel32!BaseThreadInitThunk+0x19
0466fd28 7799827e ntdll!__RtlUserThreadStart+0x2f
0466fd38 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
002ff654 77e8e0f3 ntdll!RtlpLowFragHeapFree+0xc5
002ff66c 77e94906 ntdll!RtlFreeHeap+0x105
002ff680 77e93e85 ntdll!RtlpFreeDebugInfo+0x3c
002ff6c0 54fac99f ntdll!RtlDeleteCriticalSection+0xd6
002ff6d8 54fa513d CfgRelayEx!__acrt_lowio_destroy_handle_array+0x22
002ff6e4 54fa81c5 CfgRelayEx!__acrt_uninitialize_lowio+0x15
002ff6fc 54fa12e7 CfgRelayEx!__acrt_execute_uninitializers+0x2f
002ff708 54f88fac CfgRelayEx!__acrt_uninitialize+0xf
002ff714 54f892fe CfgRelayEx!__scrt_uninitialize_crt+0x1a
002ff750 54f8918f CfgRelayEx!dllmain_crt_process_detach+0x60
002ff75c 54f893df CfgRelayEx!dllmain_crt_dispatch+0x4e
002ff79c 54f8947d CfgRelayEx!dllmain_dispatch+0xaf
002ff7b0 77e99280 CfgRelayEx!_DllMainCRTStartup+0x1c
002ff7d0 77eb8f88 ntdll!LdrpCallInitRoutine+0x14
002ff874 77eb8e2a ntdll!LdrShutdownProcess+0x1aa
002ff888 75627a3c ntdll!RtlExitUserProcess+0x74
002ff89c 0035275a kernel32!ExitProcessStub+0x12
002ff8a8 003526ef srvhost!exit_or_terminate_process+0x40
002ff8e0 00352895 srvhost!common_exit+0xee
002ff8f4 00347e90 srvhost!exit+0x11
002ff934 7562343d srvhost!__scrt_common_main_seh+0x179
002ff940 77e99812 kernel32!BaseThreadInitThunk+0xe
002ff980 77e997e5 ntdll!__RtlUserThreadStart+0x70
002ff998 00000000 ntdll!_RtlUserThreadStart+0x1b