Windows Notepad Vulnerability Fixed in February Update

Microsoft has addressed a critical security flaw in the Windows Notepad application as part of its February 2026 Patch Tuesday updates. This vulnerability, identified as CVE-2026-20841, poses a significant risk due to its potential for remote code execution.

Discovery and Analysis of the Flaw

The vulnerability was initially discovered by researchers Cristian Papa and Alasdair Gorniak from Delta Obscura, and further analyzed by the TrendAI Research team, including Nikolai Skliarenko and Yazhi Wang. It involves a command injection flaw that can lead to the execution of arbitrary commands on a victim’s computer.

Exploiting this vulnerability requires tricking a user into opening a malicious Markdown file and clicking on a harmful hyperlink, which allows attackers to run commands under the user’s security context.

Technical Details and Impact

The modern Windows Notepad, which is distributed via the Microsoft Store, supports rendering for Markdown files with the .md extension. When such files are opened, Notepad processes their contents and renders links interactively. The flaw is present in the function sub_140170F60(), which interacts with the Windows API call ShellExecuteExW().

This function inadequately filters input, failing to block dangerous protocol URIs like file:// and ms-appinstaller://, which can be used to execute remote or local files without standard security warnings. The vulnerability affects Notepad versions 11.2508 and earlier.

Mitigation and Recommendations

Microsoft has issued a fix for this flaw in Notepad build 11.2510 and later, available through the Microsoft Store. It is crucial for organizations to enable automatic updates and ensure compliance with the latest versions to mitigate potential risks from this vulnerability.

The Zero Day Initiative outlines that exploiting this flaw typically involves delivering a manipulated file via email or social engineering tactics and convincing the user to open it in Notepad. While .md files are not typically associated with Notepad, manual opening triggers Markdown rendering.

There are currently no workarounds for this flaw, and user interaction is required for exploitation. Therefore, users should remain vigilant and update their systems promptly.

For ongoing cybersecurity updates, follow us on Google News, LinkedIn, and X. Contact us to share your cybersecurity stories and insights.