Windows 11 Notepad Flaw Let Files Execute Silently via Markdown Links
5 66Microsoft has patched a high-severity vulnerability in Windows 11's Notepad that allowed attackers to silently execute local or remote programs when a user clicked a specially crafted Markdown link, all without triggering any Windows security warning.
The flaw, tracked as CVE-2026-20841 and fixed in the February 2026 Patch Tuesday update, stemmed from Notepad's relatively new Markdown support -- a feature Microsoft added after discontinuing WordPad and rewriting Notepad to serve as both a plain text and rich text editor. An attacker only needed to create a Markdown file containing file:// links pointing to executables or special URIs like ms-appinstaller://, and a Ctrl+click in Markdown mode would launch them. Microsoft's fix now displays a warning dialog for any link that doesn't use http:// or https://, though the company did not explain why it chose a prompt over blocking non-standard links entirely. Notepad updates automatically through the Microsoft Store.
5 comments
Oh Microsoft... (Score: 5, Insightful)
by yo303 ( 558777 ) on Thursday February 12, 2026 @11:41PM (#65986102)
You took something simple like Notepad, added features we didn't want, and not only made it worse but actually made it insecure and fundamentally broken.
This could have been prevented by not removing Wordpad.
Wrong (Score: 5, Insightful)
by ebunga ( 95613 ) on Friday February 13, 2026 @12:05AM (#65986120)
The goal of Microsoft is to keep turning record profits after they saturated the market 30 years ago. Want to make sure your endpoints are up to date on patches? They now have a subscription for that. Want to avoid installing crap like this in the first place? They have a subscription for that too.
Re:Wrong (Score: 5, Interesting)
by Ol Olsoc ( 1175323 ) on Friday February 13, 2026 @05:12AM (#65986338)
What Microsoft overlooks is that there is a red line where they will just die if they cross it. They are dangerously close to that line and may be over it. I mean, how utterly incompetent can you get? A mistake like the one here can only happen if security aspects were completely ignored during development.
Any good monopolist knows that they have to deliver at least somewhat reasonable quality to retain the monopoly. MS does not understand that. Hence their products are now incompetently made toys.
This. They crossed that line for me a good while ago. Like Windows 8 ago. And taking a simple but still useful product like Notepad, and bitching it up to the point that it is now a malware vector has me shaking my head, not in disbelief, but "here we go again". At this point, I only use my Windows Laptop if there's no other choice. I swapped out the space it was in for a Raspberry Pi 5 I've been playing with, and my not updatable to Windows 11 laptop that screams along on Linux Mint.
Now for myself, a geek - it's not all that surprising to abandon Microsoft as much as possible. But I'm getting feedback And am giving instructions from and to quite a few others who aren't such geeks. Technical adjacent. People who need a stable platform, who need a bit more than email, and web browser. And are tired of Windows update hell. And some times Microsoft even bitches up their own programs.
There are still a fair number off people out there who believe Microsoft is some kind of permanent entity. That it will be the goto solution until the universe experiences proton decay. Reminds me of Ozymandias "My name is Microsoft, King of Kings: Look on my works, ye Mighty, and despair!"
Good Low Level video on it (Score: 5, Insightful)
by caseih ( 160668 ) on Friday February 13, 2026 @12:30AM (#65986144)
Youtuber Low Level did a pretty good video on this vulnerability. Yes it is a bad vulnerability and yes it is serious, but it's not like a user isn't warned several times when clicking on such a link.
He also pointed out that the drive to put AI into everything now makes restricting process permissions a lot harder. For example in the past there was no reason to ever let notepad.exe access the internet. Now with copilot integrated, it's regularly accessing the internet. I don't think the boys at MS were thinking this through clearly.
https://youtu.be/sZ8aAkeZ6dw [youtu.be]
Re:Can we just get the old notepad back please? (Score: 5, Informative)
by TwistedGreen ( 80055 ) on Friday February 13, 2026 @09:55AM (#65986564)
You can still do that, you just need to jump through some hoops
- Disable app execution aliases for notepad.exe
- Uninstall the new notepad "app"
- Your old notepad application will be restored. It was never removed, and still lurks quietly in the C:\Windows\System32 folder.