CVE-2026-20841: Windows Notepad Remote Code Execution Vulnerability

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerability in Notepad's Markdown Feature Allows Remote Code Execution Researchers have discovered a vulnerability in Notepad's newly added Markdown support that can be exploited for remote code execution (RCE). This flaw, tracked as CVE-2026-20841 with a severity score of 8.8, was addressed in Microsoft's latest Patch Tuesday updates. The exploitation requires social engineering tactics, making it less severe than other vulnerabilities. 73 sources 56