Billions at Risk: Critical Windows Notepad Flaw Allows Remote Code Execution

Microsoft patched a critical Remote Code Execution vulnerability (CVE-2026-20841) in the Windows Notepad app that allows command injection via a specially crafted Markdown link; when a user opens the malicious .md file and clicks the link, Notepad can launch unverified protocols that load and execute remote files, running with the victim's privileges (CVSS 8.8). Administrators are urged to update Notepad via Microsoft Store or Windows Update; the report notes the patch was part of Microsoft’s February 2026 Patch Tuesday addressing multiple high-priority flaws.