Microsoft patches concerning Windows 11 Notepad security flaw – Markdown issues could have let hackers slip in malware without warning

• Microsoft patches Windows 11 Notepad RCE flaw CVE-2026-20841
• Vulnerability exploited Markdown links to execute malicious code with user permissions
• Patch Tuesday update fixes issue; versions 11.2510 and earlier remain vulnerable

Microsoft has patched a remote code execution (RCE) flaw in Windows 11 Notepad which could have allowed threat actors to run malware locally without the OS prompting the user at all.

Notepad is one of the oldest programs on Windows, having been present since its inception – however, it has evolved throughout the years, and with Windows 11, it now supports the Markdown format, which uses symbols for formatting – for example, adding an asterisk before and after a word makes it italic, and two asterisks make it bold.