Windows Notepad Vulnerability Allows Attackers to Execute Malicious Code Remotely

Microsoft disclosed and patched CVE-2026-20841, a critical remote code execution flaw (CVSS 8.8) in the Microsoft Store version of Notepad where crafted Markdown hyperlinks using custom protocol handlers can trigger command injection and remote file execution when a user opens a malicious .md file and clicks the link; Microsoft released a fix (Notepad build 11.2510+) and advises updating, avoiding untrusted Markdown files, and enabling app auto-updates.