Windows Notepad Markdown Link Validation Flaw Enables Arbitrary Command Execution

Microsoft patched a high-severity remote code execution issue in the modern Windows Notepad (Microsoft Store version) tracked as CVE-2026-20841, where improper validation of links in Markdown (.md) files can lead to arbitrary command execution in the context of the logged-in user. The flaw can be triggered when a victim opens a specially crafted Markdown file and clicks a rendered hyperlink; Notepad’s Markdown rendering/tokenization pipeline turns link text into interactive elements, and the click handler passes attacker-controlled link values onward with insufficient sanitization.

Technical reporting indicates Notepad forwards the link target to ShellExecuteExW() with only minimal filtering (e.g., stripping leading/trailing slashes), allowing malicious protocol URIs such as file:// and ms-appinstaller:// to be invoked via registered protocol handlers. Exploitation is primarily social-engineering driven (email, downloads, or other delivery mechanisms) and requires user interaction (opening the file and clicking the link), but can result in execution of attacker-chosen commands or loading attacker-controlled content depending on protocol handler behavior and system configuration; the issue was disclosed via Zero Day Initiative and credited to researchers including Cristian Papa and Alasdair Gorniak (Delta Obscura), with additional analysis referenced by third-party reporting.