Windows Notepad is now complex enough to have a serious security flaw
At the risk of going into old-man-yells-at-cloud mode, I remember when Notepad was the most basic text editor around. Some coders and writers liked the program—which comes included in every single version of Windows (and earlier)—for that reason. But Microsoft has been building out Notepad ever since it killed off Wordpad… and now Notepad is complex enough to support remote code execution. Neat.
For the uninitiated, remote code execution (RCE) is a security vulnerability that allows an external program to be loaded and run without the user’s permission or knowledge. It’s a kind of attack that shouldn’t even be possible in a super-basic text editor. But with tons of new features in Notepad—up to and including integration with “AI” via Copilot—it’s a lot more vulnerable than it used to be. The latest problem comes from Notepad’s support of Markdown, a basic formatting system, which was added in July of 2025.
The new issue was highlighted by Microsoft itself in a security bulletin. It goes like this: the user downloads a file with Markdown-formatted text inside, then opens it with Notepad. Thanks to that Markdown support, a link appears with web-standard highlighting like this. Most users would recognize that this link leads to a website… but it’s also possible for it to initiate a remote code download, which is not something Notepad could do even just a year ago. The remote code would then activate with the same level of permission as the Windows user.
The problem gets a standardized CVSS score of 8.8/7.7, making it a high security issue for Microsoft with no current solution. Fortunately, it requires a separate file download and very deliberate user interaction, so it takes a bit of work to actually execute an attack. (It would need to be combined with a bit of social engineering and trickery for maximum effectiveness.) The good old “don’t download anything from untrustworthy sources” advice applies here.
This is an issue that previous versions of Notepad didn’t have. But here I have to mention that just because you’re using a less “modern” alternative doesn’t mean you’re completely safe. For example, Notepad++ (a non-Microsoft open-source program that’s been popular with power users for decades) was recently compromised by a targeted attack on the app’s update servers.