Windows Notepad Is Now a Security Risk – Yes, Really

In what feels like a parody headline but unfortunately isn't, Microsoft has warned of a security vulnerability in Windows Notepad. The tiny text editor that once did nothing more than display plain text can now, apparently, help run malware on your system.

There is no patch available yet

Once upon a time, Notepad was famously boring. And that was its charm. Programmers and writers appreciated it precisely because it did almost nothing. It was simple, predictable, and blissfully incapable of doing harm.

Then Microsoft decided it needed "features"

After retiring WordPad, Microsoft began turning Notepad from a digital sticky note into something far more ambitious. It now includes Markdown support and even AI integrations via Copilot. And with this newfound ambition comes something no one asked for: remote code execution capabilities.

Remote code execution (RCE) is a serious security flaw that allows external code to run on a system without the user realizing what’s happening. In other words, exactly the sort of thing that absolutely should not be possible in a minimal text editor. The latest issue originates from Markdown support, added in July 2025, because apparently plain text was no longer exciting enough.

How the attack works

Microsoft disclosed the vulnerability in its own security bulletin CVE-2026-20841.

Here is the basic scenario:

• A user downloads a Markdown-formatted file.

• They open it in Notepad.

• The file contains what looks like a harmless web link.

• The user clicks it.

Instead of opening a normal website, the link triggers the download and execution of remote code. The malicious code then runs with the same privileges as the user who opened the file. In short: if you’re an admin, so is the attacker.

This works because Notepad now supports clickable links and external protocol handling. Features it did not have back when it was just a harmless text box.

The vulnerability carries a CVSS rating of 8.8 (7.7 in some contexts), placing it firmly in high risk territory. At the time of writing, there is no fix available.

How to protect yourself

The good news? This is not a zero-click apocalypse. An attacker needs you to:

• Download a file from somewhere untrusted

• Open it in Notepad

• Click a malicious link inside it

So the timeless security advice still applies:

• Do not download files from unknown or suspicious sources.

• Be cautious about clicking links inside local documents.

• Consider disabling Markdown features or link handling if possible.

It is remarkable that in 2026 we now have to think twice before opening a text file in Notepad. But here we are, living in the future where even the simplest Windows tool can execute remote code.