Microsoft has fixed a high-severity remote code execution vulnerability in Windows 11 Notepad that allowed attackers to execute local or remote programs simply by tricking users into clicking specially crafted Markdown links.
⚠️ What happened?
With the introduction of Markdown support in Notepad, clickable links inside .md files became interactive.
Attackers could abuse file://, ms-appinstaller://, and other special URI schemes to launch executables without triggering standard Windows security warnings.
💥 Impact
• Code execution in the context of the logged-in user
• Potential remote payload execution via SMB shares
• No initial Windows security warning dialog
• Easily weaponized through social engineering
🔗 A malicious Markdown file viewed in Markdown mode could display a clickable link.
When Ctrl+clicked, the link could execute files directly — until now.
🛠 Fix details
Microsoft now prompts users with a warning dialog for non-HTTP/HTTPS links (e.g., file:, ms-settings:, ms-appinstaller:).
The vulnerability was patched in the February 2026 Patch Tuesday updates, and Notepad updates are automatically available via the Microsoft Store.
📌 Why this matters
This flaw highlights how even “simple” applications gain risk as new features are added — especially when file-handling logic interacts with system protocols.
