Microsoft fixes Notepad flaw that could trick users into clicking malicious Markdown links

Source: The Verge

Microsoft patches critical Notepad Markdown vulnerability

Microsoft has released a fix for a serious security vulnerability affecting Markdown files in Notepad. In the Tuesday patch notes, the company explained that a malicious actor could execute remote code by tricking users into clicking a malicious link inside a Markdown file opened in Notepad, as previously reported by The Register.

Clicking the link would “launch unverified protocols,” allowing attackers to remotely load and execute malicious files on a victim’s computer. The vulnerability is identified as CVE‑2026‑20841. Microsoft stated that there is no evidence of the vulnerability being exploited in the wild, but it issued a patch to address the issue.