Windows 11 Notepad Flaw Let Files Execute Silently via Markdown Links

Source: Slashdot

Overview

Microsoft has patched a high‑severity vulnerability in Windows 11’s Notepad that allowed attackers to silently execute local or remote programs when a user clicked a specially crafted Markdown link, all without triggering any Windows security warning.

Technical Details

The flaw, tracked as CVE‑2026‑20841 and fixed in the February 2026 Patch Tuesday update, stemmed from Notepad’s relatively new Markdown support—a feature Microsoft added after discontinuing WordPad and rewriting Notepad to serve as both a plain‑text and rich‑text editor.

An attacker only needed to create a Markdown file containing file:// links pointing to executables or special URIs such as ms-appinstaller://. When a user performed a Ctrl+click on the link in Markdown mode, the target would launch.

Mitigation

Microsoft’s fix now displays a warning dialog for any link that does not use http:// or https://. The company did not explain why it chose a prompt over blocking non‑standard links entirely. Notepad updates automatically through the Microsoft Store.