Microsoft Patches Notepad Markdown Vulnerability

Microsoft has patched a high-severity vulnerability in its Windows Notepad application that could allow attackers to execute malicious code remotely through malicious Markdown files. The flaw, tracked as CVE-2026-20841, was addressed in the company's February 2026 security updates, released on February 10.

The vulnerability stems from Notepad's recently added support for Markdown, a lightweight formatting language that enables features like bold text, italics, and tables. Introduced in mid-2025, this capability allows users to open and render .md files directly in the app. However, improper handling of special elements in Markdown links created an opening for exploitation. An attacker could craft a file with a seemingly innocuous link; when a user opens the file in Notepad and clicks the link, the app would launch unverified protocols, downloading and running remote code. This code executes in the context of the user's permissions, potentially granting attackers access to the same level of control over the system, including administrative rights if the user has them.

The issue requires user interaction and a network connection, making it reliant on social engineering tactics to...