CVE-2026-20841 (CVSS 8.8) Windows Notepad RCE via Markdown

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Windows Notepad and RPC Identified CVE-2026-20841, a critical vulnerability with a CVSS score of 9.8, affects Windows Remote Procedure Call (RPC) and allows unauthenticated remote code execution. Additionally, a related issue in Windows Notepad, with a CVSS score of 8.8, enables remote code execution via malicious Markdown files. Both vulnerabilities were published on February 10, 2026, with proof of concept released the following day. 3 sources 58