PoC Released for Windows Notepad Vulnerability that Enables Malicious Command Execution
Microsoft has addressed a high-severity remote code execution (RCE) vulnerability in the modern Windows Notepad application, identified as CVE-2026-20841 , as part of its February 2026 Patch Tuesday release cycle .
Microsoft has addressed a high-severity remote code execution (RCE) vulnerability in the modern Windows Notepad application, identified as CVE-2026-20841 , as part of its February 2026 Patch Tuesday release cycle .
The vulnerability, which involves command injection, was initially discovered by Cristian Papa and Alasdair Gorniak of Delta Obscura, with further analysis conducted by Nikolai Skliarenko and Yazhi Wang of the TrendAI Research team.
Exploitation allows an attacker to execute arbitrary commands under the victim’s account security context by inducing the user to open a specially crafted Markdown file and click on a malicious hyperlink.
The modern Windows Notepad, distinct from the legacy Notepad.exe and available through the Microsoft Store, supports Markdown rendering for files with the .md extension. Upon opening a Markdown file, Notepad processes its contents and renders links interactively.
The vulnerable function, sub_140170F60() , manages click events on these links and passes the link value to the Windows API call ShellExecuteExW() after minimal filtering.
Upon opening a Markdown file, Notepad processes its contents and renders links interactively.
This filtering only removes leading and trailing backslashes and forward slashes, failing to block malicious protocol URIs like file:// and ms-appinstaller:// , which can be exploited to load and execute attacker-controlled files without triggering standard Windows security warnings.
According to the Zero Day Initiative , exploiting this vulnerability requires an attacker to deliver a malicious file via email, a download link, or social engineering tactics. The victim must then open the file in Notepad and press Ctrl + click on the embedded malicious link.
Although .md files are not associated with Notepad by default, manually opening them triggers Markdown rendering, enabling the exploit. A public proof-of-concept is available on GitHub .
This vulnerability impacts Notepad versions 11.2508 and earlier, with the fix provided through the Microsoft Store in build 11.2510 and later. The legacy Notepad.exe is unaffected.
Microsoft has not provided any workarounds and requires user interaction for exploitation. Organizations should ensure that automatic Microsoft Store updates are enabled and enforce version compliance across managed endpoints to ensure full remediation.
Based on reporting by Cyber Security News.