Not impossible, but very unlikely. CLFS isn’t remotely reachable, it's a kernel driver reached through local API calls and has no network listener. AFAIK the historical CLFS CVEs are all rated as local.

▲

waz0wski a day ago | parent [-]

There was an RCE recently disclosed for ... paint.exe - CVE-2026-83844

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

So really anything is on the table at this point

	▲	antx 11 hours ago \| parent [-]
		Except, once again Microsoft crapped the bed... it's not an RCE in any capacity... > Revision 2.1, Nov 7: “Added an FAQ and updated the CVSS score. This is an informational change only.” > Vector: now AV:L and UI:R (local attack vector, user interaction required), scoring 7.0.