Feb 11, 2026

Tags: Security , Ops

Complexity: easy

Notepad Can Run Code Now. No, Not Like That.

Remember when Notepad was just… Notepad?

A simple, lightweight, no-nonsense text editor. The one app on your Windows machine that you knew couldn’t hurt you. No macros. No scripting engine. No plugins. Just plain text on a screen.

Well. Microsoft decided to change that.

And now Notepad can execute arbitrary code on your machine.

Let that sink in.

A Quick History Lesson

In 2024, Microsoft killed WordPad. Gone. Removed from Windows 11 24H2.¹

A lot of people asked: “Where do I go for basic formatting now?”

Microsoft’s answer? Notepad.

In May 2025, they started rolling out Markdown support to Notepad. Bold text, italic, headings, hyperlinks — the works. A formatting toolbar. A toggle between rendered Markdown and raw syntax view.²

Some people loved it. Many people hated it. The critics said Notepad was losing its soul. It was supposed to be simple. Fast. Invisible. Now it was becoming a mini-WordPad.

Then in September 2025, they added AI writing features. Because of course they did.

But here’s the thing nobody saw coming: that shiny new Markdown renderer? It shipped with a command injection vulnerability.

An 8.8 CVSS score. That’s not a typo.

CVE-2026-20841: The Vulnerability

Let’s talk about what actually happened.

The vulnerability is tracked as CVE-2026-20841, classified under CWE-77: Improper Neutralization of Special Elements used in a Command.³

In plain English: when Notepad renders a Markdown file, it processes hyperlinks. Those links can point to URLs. But they can also point to protocol handlers — custom URI schemes that tell Windows to launch specific applications.

The problem? Notepad didn’t validate which protocols were safe.

An attacker could craft a Markdown file with a link that, when clicked, triggers an unverified protocol handler. That handler loads and executes files with the current user’s permissions.⁴

No admin rights needed. No privilege escalation required. Just click a link in a text file.

That’s it. That’s the whole attack chain. Open file. Click link. Game over.

The CVSS Breakdown

Let’s look at why this scored an 8.8 out of 10:

The only thing keeping this from a 9+ is that single “User Interaction: Required.” You have to click. That’s the entire safety net.⁵

Why This Is Worse Than It Sounds

“But it requires user interaction! People won’t just click random links!”

Right. Because phishing never works. Nobody ever clicks suspicious links.

Oh wait. Phishing is literally the number one initial access vector for cyberattacks. It has been for years. People click things. That’s what people do.

And consider the context: this is Notepad. The app everyone trusts. The app that’s been harmless for over 30 years. If someone sends you a .md file and says “hey, check out these notes,” you’re going to open it. And when you see a nicely rendered Markdown document with a helpful-looking link… yeah. You’re going to click it.

The Bigger Pattern: Text Editors Under Siege

Here’s something wild. Just nine days ago, I wrote about how Notepad++ was hijacked by state-sponsored hackers through a compromised update mechanism. A Chinese APT group called Lotus Blossom infiltrated the hosting infrastructure and served malicious updates to targeted users for six months.

Now Windows Notepad has its own RCE.

Two text editors. Two completely different attack vectors. Same result: your “harmless” text editor becomes a weapon.

It’s almost poetic. The open-source community’s beloved text editor got hit through its supply chain. Microsoft’s built-in text editor got hit through a feature nobody asked for.

Different roads, same destination.

What’s Affected

This vulnerability affects Windows Notepad versions 11.0.0 through 11.2509.⁵

If you’re running Windows 11 and you haven’t specifically disabled Markdown support in Notepad’s settings, you’re running a vulnerable version right now.

The good news: Microsoft patched it in the February 2026 Patch Tuesday update on February 10, 2026. The fix is Notepad version 11.2510.⁶

The bad news: this Patch Tuesday was a beast. 58 total flaws. Six actively exploited zero-days. Three publicly disclosed. This Notepad bug is just one of twelve remote code execution vulnerabilities patched.⁶

Twelve RCEs in one month. Just let that number sit with you for a second.

Detection: What To Watch For

If you’re a sysadmin or you run a SOC, here’s what to look for:

• Notepad.exe spawning cmd.exe or PowerShell — this should never happen under normal circumstances
• Notepad.exe making outbound network connections — plain text editors don’t phone home
• Unusual process chains originating from Notepad after a user opens a .md file
• Encoded payloads or suspicious arguments in processes spawned by Notepad

If Notepad is spawning shell processes, something is very, very wrong.

What You Should Do Right Now

1. Update Windows Immediately

Apply the February 2026 Patch Tuesday update. This patches Notepad to version 11.2510, which fixes CVE-2026-20841 along with 57 other vulnerabilities.⁶

2. Disable Markdown Rendering (If You Don’t Need It)

Open Notepad → Settings → Turn off text formatting / Markdown support. If you don’t need fancy rendered text in your text editor (and let’s be honest, did you ever?), turn it off. Reduce your attack surface.

3. Don’t Open Random .md Files

Treat .md files from unknown sources the same way you’d treat .exe files. Just because it’s “just a text file” doesn’t mean it’s safe anymore. We’re past that.

4. Monitor for Anomalous Notepad Behavior

If you’re running an EDR solution, create a rule to flag Notepad spawning child processes. That’s not normal. That’s never normal.

The Irony Is Not Lost

Microsoft killed WordPad because it was too bloated. They added WordPad’s features to Notepad. And in doing so, they introduced the kind of vulnerability that WordPad never had.

The people who said “just leave Notepad alone” are having the smuggest day of their lives right now. And honestly? They earned it.

A text editor that can execute arbitrary code isn’t a text editor anymore. It’s an attack surface with a blinking cursor.

No known exploitation in the wild yet. But there’s a proof-of-concept on GitHub already.⁷ The clock is ticking.

Patch your systems. Disable what you don’t need. And maybe, just maybe, stop adding features to things that were perfect the way they were.