Microsoft addresses Notepad vulnerability that could mislead users into clicking harmful Markdown links.

Microsoft has addressed a significant security flaw in Notepad that impacts Markdown files. According to the latest patch notes, a malicious actor could potentially execute remote code by deceiving users into clicking a harmful link within a Markdown file opened in Notepad. This action could trigger “unverified protocols,” enabling attackers to remotely load and run harmful files on the victim’s system. While Microsoft has stated that there is no evidence of this vulnerability (CVE-2026-20841) being exploited in the wild, they have released a fix in their recent update.

Markdown support was introduced to Notepad on Windows 11 last May, which sparked some backlash regarding the perceived bloatware in the operating system, as new features and AI functionalities have been added to applications like Notepad and Paint. Notepad isn’t alone in facing security challenges; the third-party text editor Notepad++ recently revealed that some users might have inadvertently downloaded a malicious update associated with state-sponsored attackers from China.