Remember when Notepad was just… Notepad? A simple text editor nobody asked to be modernized?
Yeah, Microsoft didn’t care either. They bolted on Markdown support and AI features anyway. And now we’ve got CVE-2026-20841. Remote code execution. Via a text file. This is the kind of thing that makes you go “oh come on, really?”
You know what’s really stupid about this
Notepad existed for decades, resisting the general trend of Microsoft software, and it continued to do one thing, and do it well (for the purposes of this argument, let’s not get started on line endings)
If someone wanted to do more than just view text files, there was wordpad, a stripped down word processor, that would have been the perfect application to add support for markdown to.
Except they killed it, because enough people must have realised that the word processor bundled with the OS did everything they needed without having to pay Microsoft a subscription for Word.
So now Microsoft is trying to turn notepad into the rudimentary word processor that people expect to come with their OS, destroying the aspect that made it useful
…let’s not get started on line endings
Aww! But, Mom…!
Mom: we have \n at home.
At home: \r
Oh, so that’s the reason you & Dad are always fighting!
Yes but I bet the young developers at Microslop have never used notepad or wordpad or even windows 95, so they think the best apps are made in electron with JavaScript, or in dotnet.
From my post elsewhere on this topic:
Yet another in my ongoing series of headlines about how messed up Microsoft and tech in general is by using just Notepad as an example.
Why Notepad? Because it was supposed to be the most basic built in text editor for the Windows environment. They thing that would always work. The thing that would do exactly what it was supposed to no matter what.
They have messed it up so bad that it’s now an attack vector.
It’s the prime example of how they keep taking things that work and make them worse.
A few months ago (maybe a year) I found myself in a situation where I had to uninstall and re-install the native Calculator to Windows because of some error. How in the hell did they mess up a calculator? Well the same way they probably messed up the closest thing we have to pencil and paper on Windows.
This has nothing to do with AI. They added markdown to it and now links work.
The title of the article is weird because it’s the only place AI is mentioned.
Why, you know on Earth, would they add “ai” to notepad of all things?
“Why not?” retorts Mr. Nadella, as a grin begins to form. He exchanges a meaningful look with Mr. Suleyman.
Have they made notepad a webapp yet? Lol.
They’ve been enshittifying it for over a year.
Use LibreOffice instead. It’s available on both Windows and Linux.
Isn’t the point of a RCE that the user doesn’t need to click and run the malicious code? What makes this different from the user opening a site on a browser which is filled with links?
the browser knows its opening links and has a code base on how to do that
notepad isn’t suppost to fetch data when the file it opens contains code that acts like a link
Does it not invoke the browser to do it? The article and associated pages don’t really go into how the whole flow it works.
It uses a more generic shell linking method, that doesn’t just load web URLs but also file paths, including to executables.
https://nvd.nist.gov/vuln/detail/CVE-2026-20841 this page would contain the best details on the CVE, there is a link to a forum discussing it
I don’t know for sure but I suspect it is like many of the other types of exploits where someone makes a normal looking URL but inside of it hides conditions that makes whatever is inspecting the URL to know that it should open in the web browser do something before it opens the web browser. Like before it starts the web browser does it it tells it to download some code and run it and that code then hijacks your “system” because the system service is running the code
Can anyone tell me if Win 10 LTSC IoT 21H2 is also affected? This is the only M$ OS I run on a few devices (I pretentiously use Linux BTW). If notepad.exe on LTSC is still being molested by updates, that’s beyond fucked.
I don’t think it does. The MSRC page linking to the notepad update release notes/download goto the windows store version of notepad, which lists a requirement of Windows 11 version 22000.0 or higher.
I haven’t gone more in depth than that though.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841
Thanks for the info!
