Windows 10: Windows 11 Notepad Bug Let Markdown Links Run Files Without Warning

Microsoft has patched a high-severity security vulnerability in Windows 11 Notepad. This system bug allowed specially crafted Markdown links to launch local or remote programs without triggering standard Windows security warnings.

The flaw tracked as CVE-2026-20841 was fixed as part of the February 2026 Patch Tuesday updates, which we release monthly.

While exploitation required a user to open a malicious Markdown file and click a link, the lack of any warning prompt made the issue especially dangerous.

Microsoft fixes Windows Notepad RCE flaw


In vulnerable versions (Windows Notepad 11.2510 and earlier):

• Links using protocols like file://, ms-appinstaller://, and other custom URI schemes
• Became clickable in Markdown view
• Launched executables directly when Ctrl+clicked
• Displayed no Windows security warning

This meant an attacker could:

1. Create a malicious Markdown (.md) file
2. Insert a link pointing to a local or remote executable
3. Trick a user into clicking it

If clicked, the program would run with the same permissions as the logged-in user.

In some cases, the link could point to a file hosted on a remote SMB share, expanding the potential attack surface.

Microsoft patched a high-severity flaw in Windows 11 notepad


Microsoft has now implemented stricter safeguards.

Windows Notepad will now:

• Display a warning dialog for any link that does not use standard http:// or https:// protocols
• Require explicit user confirmation before proceeding

This eliminates the previous silent execution behavior.

While social engineering remains possible (users could still click “Yes”), the automatic launch without warning is no longer an issue.

Windows Notepad: Editor's Evolution


Notepad has evolved significantly since its debut in Windows 1.0. With Windows 11, Microsoft modernized the app by:

• Adding Markdown support
• Enabling richer formatting features
• Retiring WordPad as the default RTF editor

Markdown support allows users to create formatted text and clickable links using simple syntax, such as:

• **Bold text**
• [Example Link](https://example.com)

However, researchers discovered that Notepad did not properly restrict non-standard protocols inside Markdown links.

This vulnerability highlights an important lesson:

"Even simple apps can introduce serious security risks when new features are added."
​

Markdown support made Notepad more powerful and flexible - but it also expanded the application’s attack surface.

CVE-2026-20841 Update Status


Because Notepad updates automatically through the Microsoft Store, most Windows 11 users should receive the CVE-2026-20841 fix without manual action.

Still, keeping Windows fully updated remains essential, especially when vulnerabilities involve remote code action.

Thank you for being a Ghacks reader. The post Windows 11 Notepad Bug Let Markdown Links Run Files Without Warning appeared first on gHacks.

read more...

 

Turn html pages into linked indexed markdown files?

I've no idea what justification you have wanting to use markdown but, hey-ho, that's your business. (Personally I think adding the requirement just needlessly overcomplicates a fairly simple need.) Here's a random interesting suggestion - build your own custom solution using AutoHotkey. Have a look at Jack Dunning's thoughts about a similar need, in which he wrote about linking URLs: I wondered:

Does this strike a chord? Hope this helps...

 

Old Notepad win 11

Thank you for your speedy reply. I went through the steps as advised and .txt is not listed in file type, it lists .tts and the next one is .txz. Also there is no notepad listed in link type.

 

How to disable Word Wrap for all files in Notepad (Windows 11) ?

I can repro the issue. Notepad doesn't seem to query the "word wrap" setting. This may have happened after the KB5022913 update, I think. Please report this in the FBH. Until this gets fixed, you can switch to classic Notepad using these steps:

1. Open Settings → Apps.
   
2. Expand “More settings” and click “App execution aliases.”
   
3. Disable the “Notepad” alias by turning off the radio button.
   

See also: How to Restore Old Classic Notepad in Windows 11

Alternatively, revert to the previous Notepad build, version 11.2204.12.0, which doesn't have this bug. No tab feature, though.

http://tlu.dl.delivery.mp.microsoft...rTEXsZfQhB+IH+2NLpG0OVWC9FKFujBVSIexJxw6qnQ== [Link is valid for the next 14 minutes)

Mirror link (via my OneDrive)

File Info: