CVE-2026-20841: Arbitrary Code Execution in the Windows Notepad

A remote code execution vulnerability was identified in Windows Notepad's Markdown rendering: insufficient link filtering allows crafted protocol URIs to be forwarded to ShellExecuteExW, enabling arbitrary command execution if a user opens a malicious .md file and clicks a link. The flaw arises from fixed extension detection and inadequate sanitization of link values; .md files are not registered to Notepad by default but are rendered when opened manually.