Main Vulnerability Database Vulnerabilities #VU122564

Command Injection in Windows Notepad - CVE-2026-20841

Published: February 10, 2026 / Updated: February 13, 2026

Vulnerability identifier: #VU122564

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-20841

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in Windows Notepad App. A remote attacker can trick a victim into clicking a malicious link inside a Markdown file opened in Notepad and execute arbitrary commands.

Affected software

Windows Notepad

How to mitigate CVE-2026-20841

Install updates from vendor's website.

Windows Notepad - update to 11.2510

Links to Public Exploits and PoC-codes

Exploit #12409 - CVE-2026-20841 (PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links) (February 13, 2026)

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Related Security Bulletins

Command Injection in Microsoft Windows Notepad App