Microsoft Patches Notepad Vulnerability to Protect Users from Malicious Markdown Links

Microsoft Fixes Critical Security Vulnerability in Notepad

A serious security flaw in Notepad that could allow remote code execution has been patched by Microsoft. The vulnerability, reported by The Register, could be exploited by a malicious actor tricking users into clicking a harmful link within a Markdown file opened in Notepad.

Clicking on the link would enable attackers to launch unverified protocols, potentially leading to the execution of malicious files on the victim’s computer. While there have been no reports of this vulnerability (CVE-2026-20841) being exploited in the wild, Microsoft released a fix for it in their recent patch.

Last May, Microsoft introduced support for Markdown, a plaintext formatting language, in Notepad on Windows 11. However, this move drew criticism for potentially bloating the operating system with unnecessary features and AI capabilities integrated into apps like Notepad and Paint.

Notepad is not the only text editor facing security concerns. Recently, the third-party app Notepad++ disclosed that some users may have unknowingly downloaded a malicious update associated with Chinese state-sponsored attackers.