CVE-2026-20841CWE-77

Windows Notepad App Remote Code Execution Vulnerability

High · published February 10, 2026

CVSS v3.1
7.8
EPSS
9%
Percentile
95.3
In the wild
Unconfirmed
What it is

⚡ A crafty command injection vulnerability in the Windows Notepad app could let attackers execute code locally — and it takes just one sneaky command! 🔥 Think of this like a restaurant where a diner can sneak a handwritten note to the chef, overriding the menu, and ordering whatever they want without approval. That's what this flaw allows in your digital workspace — unauthorized code execution! If exploited, an attacker could potentially run any command on your system, leading to unauthorized access, data manipulation, or even complete control over your machine. This is absolutely devastating for anyone using the Notepad app without proper safeguards in place!

Put simply

Think of this like a restaurant where a diner can sneak a handwritten note to the chef, overriding the menu, and ordering whatever they want without approval. That's what this flaw allows in your digital workspace — unauthorized code execution! This vulnerability arises from improper handling of special command elements within the app, enabling an unauthorized user to inject and execute arbitrary commands on the local system. It's a classic command injection issue.

What to do

If exploited, an attacker could potentially run any command on your system, leading to unauthorized access, data manipulation, or even complete control over your machine. This is absolutely devastating for anyone using the Notepad app without proper safeguards in place! To safeguard against this threat, update your Notepad app to the latest version immediately. Additionally, ensure that security policies are in place to restrict unauthorized access to your systems. Regularly audit your applications to detect and mitigate similar vulnerabilities. You've got this! With a few updates and a solid security posture, you can keep your systems safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.09006 · 95.3th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Notepad App Remote Code Execution Vulnerability
    cvelistv5