Windows Notepad App Remote Code Execution via Crafted Markdown File (CVE-2026-20841)

Scope: Windows Notepad App (Microsoft Store Version, Build 11.2510 and Earlier) on Windows 10 and Windows 11

Severity: High

A high-severity command injection vulnerability (CVSS 8.8) in the modern Windows Notepad app, patched in Microsoft's February 2026 Patch Tuesday but resurfacing as a top discussed CVE this week, allows an attacker to achieve remote code execution by tricking a user into opening a specially crafted Markdown file and clicking a malicious hyperlink inside it. The attack weaponizes Notepad's Markdown rendering feature, introduced when the app was rebuilt as a modern Universal Windows Platform application distributed through the Microsoft Store: a crafted protocol link inside the Markdown file causes Notepad to invoke unverified protocols that load and execute remote files with the current user's full permissions, including access to local files, network shares, and internal tools. The legacy notepad.exe bundled with older Windows versions is not affected. Organizations must update Windows Notepad via the Microsoft Store immediately, enable Attack Surface Reduction rules in Microsoft Defender to block command injection attempts, and train users to avoid opening Markdown files received from untrusted sources.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.