Use Notepad Quick Update 🚨

Microsoft issued a serious vulnerability patch in Notepad on Windows 11 after it encountered a CVE-2026-20841 code security problem, which is classified as a Remote Code Execution (RCE) type vulnerability and has a severity rating of up to 8.8 according to the CVSS standard. This vulnerability gives an attacker the opportunity to remotely execute malicious code on the victim machine if the user opens a file that is designed to attack and clicks a link within such a file.

.

The cause of the problem stems from the Markdown display feature in a new version of Notepad from the Microsoft Store, which supports clickable links but has a URI Scheme check flaw, allowing non-hopefuls to embed special links such as file: / / or other protocols into .md files.

.

When a user opens a file and clicks a specially created link, the system may immediately command without the user's knowledge and no security alert window appears. This results in the ability to download malware or take control of the machine. All processes can work even with User permissions. If the active account has Admin permissions, the damage can be even more severe.

.

This vulnerability hits Notepad versions before 11.2510, especially versions installed through the Microsoft Store. Although there are no reports of widespread deployment attacks, the nature of the RCE vulnerability is considered a high risk that should not be overlooked.

.

Microsoft has released an update to fix this vulnerability. Users can enter the Microsoft Store to the Download menu, then press Get Updates to update Notepad to the latest version with Windows Update fully installed. It is best to avoid opening .md files from untrusted sources and not clicking strange links within text files to prevent potential unwitting risks.

.

Source: bleepingcomputer

# IT should know # IT News # Includes IT matters # IT