Remember when Notepad was just… Notepad? A simple text editor nobody asked to be modernized?
Yeah, Microsoft didn’t care either. They bolted on Markdown support and AI features anyway. And now we’ve got CVE-2026-20841. Remote code execution. Via a text file. This is the kind of thing that makes you go “oh come on, really?”
Isn’t the point of a RCE that the user doesn’t need to click and run the malicious code? What makes this different from the user opening a site on a browser which is filled with links?
the browser knows its opening links and has a code base on how to do that
notepad isn’t suppost to fetch data when the file it opens contains code that acts like a link