Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Microsoft has patched a critical remote code execution (RCE) flaw in the Windows Notepad app, tracked as CVE-2026-20841, which could let attackers run malicious code on victims\u2019 machines.<\/p>\n
Disclosed on February 10, 2026, Microsoft Patch Tuesday updates<\/a>, the vulnerability stems from improper neutralization of special elements in commands (CWE-77: Command Injection) and carries a CVSS v3.1 base score of 8.8\/10, rated \u201cImportant.\u201d<\/p>\n The bug affects the modern Windows Notepad app, available via the Microsoft Store. An unauthorized attacker could exploit it over a network by tricking users into opening a booby-trapped Markdown (.md) file.<\/p>\n Once loaded, a malicious link inside the file prompts the app to handle unverified protocols. Clicking the link triggers Notepad to fetch and execute remote files, injecting arbitrary commands without proper sanitization.<\/p>\n Attackers craft Markdown files with hyperlinks using custom schemes (e.g., mimicking safe protocols but pointing to attacker-controlled servers). When a user opens the file in Notepad and clicks the link, the app processes it naively, leading to command injection<\/a>.<\/p>\n The payload executes in the logged-in user\u2019s security context, granting attackers the same privileges \u2013 from file access to privilege escalation if the user has admin rights.<\/p>\n The patch rolled out via the Microsoft Store for Notepad <\/a>(build 11.2510+), with full release notes and a direct security update link. Users must update manually or enable auto-updates, as it\u2019s customer action required. Microsoft credits independent researchers Delta Obscura (delta.cyberm.ca) and \u201cchen\u201d for coordinated disclosure.<\/p>\n This flaw underscores risks in everyday apps that handle rich text, such as Markdown, especially as Notepad evolves from a basic editor into a feature-rich tool. While legacy Notepad.exe remains unaffected, the Store version\u2019s popularity amplifies exposure.<\/p>\n Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n The post Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nMitigation Steps<\/strong><\/h2>\n
\n