Microsoft fixes a critical security flaw in Windows 11 Notepad that allows remote code execution using Markdown files

Microsoft has confirmed and patched a major remote code execution vulnerability in Notepad in Windows 11. The flaw, identified as CVE-2026-20841 and rated “Important” with a CVSS score of 8.8, could allow a remote attacker to execute code on a PC if the user opens a specially crafted Markdown file and clicks on a malicious link inside him.

According to the Microsoft Security Response Center (MSRC), the issue is caused by “inadequate neutralization of special elements used in a command,” a category known as command injection. This means that Notepad can launch unverified protocols from links within Markdown files, leading to remote content loading and running.

In practical terms, attackers could send a phishing email with an attached .md file. If the victim opens it in Notepad and clicks the link, malicious code could be executed with the same permissions as the user’s account. If the user has administrator privileges, the impact could be devastating, allowing data theft, modification of system files and affecting system stability.

When complicating basic software is expensive

For years, Notepad has been free of security issues for one simple reason: its extreme simplicity. Wow, it was a program that only edited plain text without formatting or the ability to process links. However, with Windows 11, Microsoft has focused its efforts on providing Notepad with more formats, including support for the Markdown language, clickable links, autosave, tabs, and integration with Copilot.

Markdown support gave Notepad the ability to interpret links within files and make them interactive. When an app built into billions of devices starts handling external protocols and content in ways the classic version never could, the risk naturally increases. Any weaknesses in how special characters or commands are processed can be exploited by attackers.

The vulnerability has a network attack vector, meaning it can be delivered remotely via email or download links, without requiring physical access. The complexity of the attack is low and does not require prior privileges, although it does require user interaction. Microsoft has rated the impact as high for confidentiality, integrity, and availability.

Fortunately, Microsoft has not observed active exploitation of this vulnerability and was not publicly disclosed before the correction. The security patch is now available as part of the February 2026 Patch Tuesday update for Windows 11 and built-in apps through the Microsoft Store.