Loading story…
Microsoft disclosed CVE-2026-20841, a remote code execution vulnerability in the Windows Notepad app, and the bug was subsequently detailed by Trend Micro's Zero Day Initiative as an arbitrary code execution issue affecting Notepad. Public references describe the flaw as enabling code execution through the handling of malicious content in Notepad, elevating concern because the application is widely present across Windows environments.
Within days of disclosure, multiple proof-of-concept repositories for CVE-2026-20841 appeared on GitHub, including projects explicitly labeling the issue as "Windows notepad.exe RCE". The rapid publication of several PoCs increases the likelihood of weaponization and lowers the barrier for attackers to test exploitation, making prompt validation of Microsoft's security update and exposure assessment a priority for defenders.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Zero Day Initiative published a blog post detailing CVE-2026-20841 as an arbitrary code execution vulnerability in Windows Notepad. This added public technical context beyond the initial vendor advisory.
Multiple GitHub repositories were created or published with proof-of-concept material for CVE-2026-20841, including references describing it as a Windows notepad.exe RCE issue. The repositories indicate public exploit details became broadly available shortly after disclosure.
Microsoft published CVE-2026-20841 in its Security Update Guide as a Windows Notepad App remote code execution vulnerability. This marks the public vendor disclosure of the issue.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
zerodayinitiative.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released a security update for **Windows Notepad** to fix `CVE-2026-20841`, a high-severity remote code execution vulnerability tracked in the Microsoft Security Update Guide. The flaw affects Notepad's handling of specially crafted **Markdown** documents and stems from improper neutralization of special elements, allowing arbitrary code execution under certain conditions. Successful exploitation requires user interaction: a victim must open a malicious Markdown file in Notepad and click a URL embedded in the document. CSIRT.SK reported the issue carries a **CVSS 8.8** rating and that a public proof-of-concept exploit is available, increasing the urgency for organizations to deploy the patch and update Windows Notepad across affected systems.
Jul 24, 2026
Microsoft patched a **Windows Notepad** command-injection vulnerability, **CVE-2026-20841** (CVSS **8.8**), that can lead to **remote code execution** when a user opens a Markdown file in Notepad and clicks a crafted malicious link. The issue is described as improper neutralization of special elements used in a command, enabling an attacker to trigger execution of remote or local payloads in the **security context of the logged-in user**. Public proof-of-concept examples indicate the flaw can be exercised using Markdown `file://` links pointing to executables (e.g., `file://C:/windows/system32/cmd.exe`) and other special URI handlers. The reporting appears as part of a broader weekly “ThreatsDay” roundup that also references other, separate security stories (e.g., AI prompt injection/RCE themes and other malware/exploit items), but the concrete, actionable item consistently detailed is the Notepad Markdown-link RCE and its patch. A separate “Daily Cyber News” post discusses Microsoft releasing fixes for multiple exploited flaws across widely deployed products, but it does not specifically corroborate the Notepad CVE or the Markdown-link exploitation path described in the roundup, making it contextually related to Microsoft patching activity but not the same discrete vulnerability story.
Jun 29, 2026
Microsoft patched a high-severity **remote code execution** issue in the modern *Windows Notepad* (Microsoft Store) app, tracked as **CVE-2026-20841** (CVSS 8.8), caused by **command injection** (`CWE-77`) tied to improper neutralization of special elements used in commands. The weakness can be triggered when a user opens a booby-trapped **Markdown (`.md`)** file in Notepad and clicks an embedded malicious link; the app can be coerced into launching **unverified protocols** that load and execute remote content, resulting in code execution in the **security context of the logged-in user** (potentially full compromise if the user has admin rights).
Jun 29, 2026