CVE-2026-20841 - Windows Notepad RCE

PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links.

Disclaimers

1. Not my discovery. Credit goes to the original researchers on the MSRC advisory. This is a PoC recreation.
2. Lower severity than it sounds. Requires more than one click in most cases (see Limitations).

PoC

Local Binary Execution (file://)

[click](file://C:/windows/system32/cmd.exe)

Launches any executable already on disk — cmd.exe, powershell.exe, mshta.exe, etc.

step 1.

step 2.

Notes

• Vulnerable Notepad builds are on Uptodown. Verify the digital signature before use.
• Test only in a VM.

Stay safe!