Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely

Overview

Microsoft has patched a critical Remote Code Execution (RCE) vulnerability in the modern Windows Notepad application, tracked as CVE?2026?20841, disclosed during the February 10, 2026 Patch Tuesday release. The flaw arises from improper neutralization of special elements in commands (CWE?77: Command Injection) and carries a CVSS v3.1 score of 8.8 rated.

The vulnerability affects the modern Microsoft Store version of Notepad, which now includes support for Markdown (.md) rendering and clickable links. Attackers can exploit this flaw by tricking users into opening a specially crafted malicious Markdown file. Once opened, clicking an embedded malicious link causes Notepad to invoke unverified or unsafe protocol handlers, enabling execution of remote files without proper sanitization.

This flaw highlights the risks associated with transforming legacy lightweight applications into modern feature-rich ones—expanding attack surfaces as new capabilities (such as Markdown rendering) are introduced into default Windows applications. Legacy Notepad.exe remains unaffected.

Who It Impacts

This vulnerability impacts:

Windows 11 and Windows 10 systems using the modern Notepad app from the Microsoft Store.
Organizations whose users interact with Markdown (.md) files, especially in developer, documentation, or technical roles.
Environments vulnerable to social engineering, including phishing emails and malicious file-delivery channels.

The legacy version of Notepad (classic Notepad.exe) is not affected.

Attackers are most likely to target:

End?users with administrative privileges
Corporate employees handling shared documents, downloads, or externally received files
High?value endpoints used for development, reporting, or documentation work

How It Impacts

An attacker can exploit CVE?2026?20841 by:

Crafting a malicious Markdown (.md) file containing a specially formed hyperlink.
Delivering the file via phishing emails, chat/file?sharing platforms, or fake downloads.
Convincing the victim to open the file in Notepad and click the embedded link.
Notepad then processes the link without adequate validation, triggering an unsafe protocol handler (e.g., file://, ms-appinstaller://) that loads remote malicious files.
The payload executes with the same privileges as the victim user, enabling command execution.

Post?Compromise Impact

Once exploited, attackers can:

Execute arbitrary code under the victim’s security context
Steal data, harvest credentials, or plant persistent backdoors
Move laterally or escalate privileges if the user has administrator rights
Corrupt system files or cause operational disruption
Trigger system instability or outages
Lead to compliance and data?protection violations if sensitive data is accessed

Although no confirmed in?the?wild exploitation had been disclosed at the time of the patch, public proof?of?concept (PoC) code exists, significantly raising the threat level.

Targeted Products

Impacted:

Windows Notepad (Modern Microsoft Store Version)
- Versions 11.2508 and earlier are vulnerable
- Fixed in build 11.2510+
Windows systems that auto-open or associate .md files with the modern Notepad renderer
Applications or systems relying on Markdown rendering or previewing within Notepad

Not impacted:

Legacy Notepad.exe

Recommendations

Immediate Mitigation Actions

Update the Notepad app from the Microsoft Store to version 11.2510 or higher.
Ensure February 2026 Patch Tuesday updates are deployed across all endpoints.
Enable automatic Microsoft Store app updates across the organization.

User Safety & Awareness

Instruct users not to open untrusted .md files or click links inside them.
Warn users about phishing campaigns distributing Markdown attachments.
Conduct rapid awareness training regarding malicious Markdown content.

Endpoint & Network Monitoring

Set detection alerts for:

notepad.exe spawning unusual child processes such as
- powershell.exe
- cmd.exe
- rundll32.exe
- mshta.exe
- wscript.exe
- regsvr32.exe
Execution of .ps1, .vbs, .hta, .exe files immediately after Notepad opens a Markdown file
Downloads to %TEMP%, %APPDATA%, or Downloads followed by suspicious process execution
Outbound HTTP/HTTPS/SMB or custom?protocol traffic initiated shortly after Markdown interaction

Use EDR, Sysmon, and firewall logs to detect:

Protocol handler launches (file://, ms-appinstaller://)
Unexpected Notepad?initiated network connections
Suspicious OAuth or credential?related activity
Abnormal user behavior such as sudden access to admin functions

Deploy IDS/IPS to detect exploitation attempts.

Policy & Hardening Controls

Restrict .md file associations to safer applications when possible
Implement application control / allowlisting to block unauthorized scripts
Enforce least privilege access and remove unnecessary admin rights
Strengthen email filtering to block malicious Markdown attachments
Ensure offline, immutable backups are maintained and tested

References