Microsoft confirms worrying Remote Code Execution security flaw in Notepad and is rolling out a fix

CVE-2026-20841 – malicious actors may be able to trick Windows 11 users into clicking a malicious link inside a Markdown (.md) file opened in Notepad.