  Write_CVT( TT_ExecContext  exc,
             FT_ULong        idx,
             FT_F26Dot6      value )
  {
    exc->cvt[idx] = value;
  }

The product dereferences a pointer that it expects to be valid but is NULL.