Skip to main content
See every side of every news story
Published loading...Updated

Notepad's new Markdown powers served with a side of RCE

The vulnerability allows remote code execution via malicious Markdown links in Notepad, fixed in February 2026 updates; no exploitation in the wild has been reported by Microsoft.

  • On Tuesday, Microsoft issued the patch that fixed a high-severity Notepad remote code execution flaw tracked as CVE-2026-20841, disclosed in Patch Tuesday updates.
  • Notepad's recently added Markdown support and AI-powered writing features modernized Windows 11 Notepad, but critics raised concerns about expanding the app's attack surface.
  • Clickable links in Markdown files can trigger unverified protocols such as file: or ms-appinstaller:, executing programs without warnings in the security context of end users who click links.
  • Microsoft says there is no evidence attackers exploited the Notepad vulnerability in the wild, and tests show Windows 11 Notepad now warns when clicking non-http links.
  • Separately, the ecosystem shows related risks as Notepad++ disclosed that it warned of a malicious update linked to Chinese state-sponsored attackers.
Insights by Ground AI

19 Articles

Think freely.Subscribe and get full access to Ground NewsSubscriptions start at $9.99/yearSubscribe

Bias Distribution

  • 67% of the sources are Center
67% Center

Factuality Info Icon

To view factuality data please Upgrade to Premium

Ownership

Info Icon

To view ownership data please Upgrade to Vantage

pcgamer broke the news in on Wednesday, February 11, 2026.
Too Big Arrow Icon
Sources are mostly out of (0)

Similar News Topics

News
Feed Dots Icon
For You
Search Icon
Search
Blindspot LogoBlindspotLocal