Loading story…
Microsoft patched a high-severity remote code execution issue in the modern Windows Notepad (Microsoft Store) app, tracked as CVE-2026-20841 (CVSS 8.8), caused by command injection (CWE-77) tied to improper neutralization of special elements used in commands. The weakness can be triggered when a user opens a booby-trapped Markdown (.md) file in Notepad and clicks an embedded malicious link; the app can be coerced into launching unverified protocols that load and execute remote content, resulting in code execution in the security context of the logged-in user (potentially full compromise if the user has admin rights).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A February 13, 2026 advisory stated that proof-of-concept exploit code for CVE-2026-20841 was already public, raising the likelihood of real-world exploitation. The advisory reiterated that the flaw affected Microsoft Store Notepad versions 11.0.0 through before 11.2510 and urged users to update.
In its disclosure and patching information, Microsoft indicated there were no known in-the-wild exploitation cases for CVE-2026-20841 at the time of release. Multiple reports noted the attack still required user interaction and social engineering.
As part of the fix, Microsoft changed Notepad so clicking non-http/https links now triggers a warning instead of silently launching unverified protocols. The update was shipped via Microsoft Store in Notepad build 11.2510+.
On February 10, 2026, Microsoft disclosed and fixed CVE-2026-20841, a CVSS 8.8 remote code execution flaw in the Microsoft Store version of Notepad. The issue allowed malicious Markdown links using unverified protocols to execute local or remote content in the user's security context.
Independent researchers Delta Obscura and "chen" reported a command-injection vulnerability in Windows Notepad's Markdown link handling to Microsoft. The flaw was later assigned CVE-2026-20841.
Microsoft began rolling out Markdown functionality in Notepad, introducing the feature later tied to the remote code execution issue. This product change provided the attack surface abused by CVE-2026-20841.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
blog.alyac.co.kr
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched a high-severity **remote code execution** issue in the modern *Windows Notepad* (Microsoft Store version) tracked as **CVE-2026-20841**, where improper validation of links in Markdown (`.md`) files can lead to arbitrary command execution in the context of the logged-in user. The flaw can be triggered when a victim opens a specially crafted Markdown file and clicks a rendered hyperlink; Notepad’s Markdown rendering/tokenization pipeline turns link text into interactive elements, and the click handler passes attacker-controlled link values onward with insufficient sanitization. Technical reporting indicates Notepad forwards the link target to `ShellExecuteExW()` with only minimal filtering (e.g., stripping leading/trailing slashes), allowing malicious protocol URIs such as `file://` and `ms-appinstaller://` to be invoked via registered protocol handlers. Exploitation is primarily social-engineering driven (email, downloads, or other delivery mechanisms) and requires user interaction (opening the file and clicking the link), but can result in execution of attacker-chosen commands or loading attacker-controlled content depending on protocol handler behavior and system configuration; the issue was disclosed via **Zero Day Initiative** and credited to researchers including Cristian Papa and Alasdair Gorniak (Delta Obscura), with additional analysis referenced by third-party reporting.
Jul 4, 2026
Microsoft released a security update for **Windows Notepad** to fix `CVE-2026-20841`, a high-severity remote code execution vulnerability tracked in the Microsoft Security Update Guide. The flaw affects Notepad's handling of specially crafted **Markdown** documents and stems from improper neutralization of special elements, allowing arbitrary code execution under certain conditions. Successful exploitation requires user interaction: a victim must open a malicious Markdown file in Notepad and click a URL embedded in the document. CSIRT.SK reported the issue carries a **CVSS 8.8** rating and that a public proof-of-concept exploit is available, increasing the urgency for organizations to deploy the patch and update Windows Notepad across affected systems.
Jul 24, 2026
Microsoft patched a **Windows Notepad** command-injection vulnerability, **CVE-2026-20841** (CVSS **8.8**), that can lead to **remote code execution** when a user opens a Markdown file in Notepad and clicks a crafted malicious link. The issue is described as improper neutralization of special elements used in a command, enabling an attacker to trigger execution of remote or local payloads in the **security context of the logged-in user**. Public proof-of-concept examples indicate the flaw can be exercised using Markdown `file://` links pointing to executables (e.g., `file://C:/windows/system32/cmd.exe`) and other special URI handlers. The reporting appears as part of a broader weekly “ThreatsDay” roundup that also references other, separate security stories (e.g., AI prompt injection/RCE themes and other malware/exploit items), but the concrete, actionable item consistently detailed is the Notepad Markdown-link RCE and its patch. A separate “Daily Cyber News” post discusses Microsoft releasing fixes for multiple exploited flaws across widely deployed products, but it does not specifically corroborate the Notepad CVE or the Markdown-link exploitation path described in the roundup, making it contextually related to Microsoft patching activity but not the same discrete vulnerability story.
Jun 29, 2026