Microsoft just patched a serious security hole in the modern Windows Notepad app, and it’s all thanks to that fancy new Markdown feature nobody asked for.
The vulnerability, tracked as CVE-2026-20841 with a severity score of 8.8, could let attackers execute code on your system just by tricking you into clicking a malicious link inside a Markdown file. No warning, no prompt, nothing.
The flaw nobody saw coming
The bug stems from how Notepad handles hyperlinks in Markdown documents. When Microsoft added Markdown support in May 2025 as part of their controversial WordPad-ification of the humble text editor, they inadvertently opened a new attack surface.
The problem? Notepad wasn’t properly validating certain protocols embedded in Markdown links, allowing attackers to craft malicious .md files that could launch unverified protocols and execute remote files without any security warning.
The exploit was straightforward: open a specially crafted Markdown file in Notepad, click a link with Ctrl+click, and boom, the Windows command prompt could launch silently, executing whatever payload the attacker embedded.
The malicious code runs with the same permissions as your user account, meaning if you’re signed in as an administrator, the damage could be devastating.
Microsoft’s fix and what you need to know
Microsoft addressed the flaw in their February 2026 Patch Tuesday updates released on February 10, alongside fixes for 58 other vulnerabilities including 6 actively exploited zero-days. The vulnerability was discovered by security researchers Cristian Papa, Alasdair Gorniak, and Chen, and Microsoft confirmed there are no known cases of exploitation in the wild.
The fix now displays a warning when clicking any link that doesn’t use http:// or https:// protocols. The patch rolled out through the Microsoft Store for Notepad version 11.2510 and later, affecting only the modern Store-based Notepad, not the legacy Notepad.exe.
If you have automatic updates enabled, you should already have the fix, though users can still bypass the warning with clever social engineering.
The irony isn’t lost on anyone. Many users opposed adding Markdown support to Notepad in the first place, arguing it should remain a simple text editor. This vulnerability validates those concerns.
Microsoft has been adding AI-powered features and expanding Notepad’s capabilities, creating what critics see as an expanding attack surface for an app that once epitomized simplicity.
You can toggle Markdown support off in Notepad’s settings if you’d rather avoid these complications, though it ships enabled by default.
What do you think, should Microsoft have left Notepad alone as a basic text editor, or are the new features worth the security risks?