There’s a category of information I think of as cursed knowledge. Facts that make your day measurably worse just by learning them. You can’t unlearn them. You just carry them now.

Here’s one: TrueType fonts have a virtual machine inside them. A real one. With an instruction set, a stack, and the ability to execute arbitrary code.

I know. I’m sorry.

If your first reaction is “that can’t be right,” I get it. Mine was too. Then I saw someone run Doom inside a font.

https://4rh1t3ct0r7.github.io/ttf-doom/

That’s Doom. In a TTF file. Rendered through the font engine on your machine.

Now, you might be thinking: “Sure Danny, but that probably needs JavaScript to handle character positioning and input. The font isn’t really doing the work.” Fair point. Reasonable objection.

So here’s Fontemon, a legally distinct Pokemon-like game, running entirely inside a font file. You can download it and play it in… Vim or something, but I guess any text field works. You don’t need a browser or javascript, all you need is your operating system’s font renderer doing things font renderers were never meant to do.

https://www.coderelay.io/fontemon.html

At this point you might be reaching for a justification. “OK but this isn’t really a virtual machine. Fonts need to support complex scripts, right? Arabic, Devanagari, CJK layouts. It makes sense that there’s some programmability in there for handling all the world’s writing systems.”

And yeah, I don’t speak every language. But I’m fairly confident that no human writing system requires the computational power to run a large language model.

Because someone did that too.

https://fuglede.github.io/llama.ttf/

That’s llama.cpp, the inference engine behind a lot of local LLM setups, compiled to run inside the TrueType instruction set. An AI model running inside a font. The text is generating itself.

Your system has hundreds of these files installed right now. You load them when you open a PDF, visit a website, read a document. Each one contains a Turing-complete execution environment. Font rendering is, by specification, arbitrary code execution.

There is no patch for this. It’s not a bug. It’s the spec. It’s been the spec since 1994.

You now know this, and you will never look at a .ttf file the same way again.

Now ask yourself how carefully you’ve vetted the fonts you’ve installed.

Welcome to cursed knowledge.