CVE-2026-20841

Think of this like a trapped letter — if someone opens a file in Notepad that looks harmless but is secretly rigged, it can trick the program into running commands the attacker chose, as if they were typing directly on your keyboard. The damage depends on what the attacker decides to do once they're in, from installing malware to stealing files.

This matters to you if any computer in your business runs Windows and uses the built-in Notepad app to open text files. It affects every user since Notepad is bundled with Windows, but an attack only works if someone is convinced to open a malicious file — it can't happen automatically or remotely without that step.

A working proof-of-concept is publicly available and press attention is rising, but there's no confirmed real-world attack yet and it isn't on the government's list of actively exploited threats. Treat this as a genuine but not yet urgent risk — plan to update soon rather than drop everything today.

1. Inventory affected endpoints by checking the installed Notepad version (Settings > Apps > Notepad, or via Microsoft Store app details) — Windows Notepad is a Store-delivered component separate from the base OS build.
2. Target fixed version 11.2510 or later for mainstream builds, and 11.2512.26.0 for the branch specified by Microsoft's advisory — confirm which applies to your deployed Windows 11 version.
3. Push the update via Microsoft Store auto-update or Windows Update for Business; no known breaking changes are reported for this update.
4. As a temporary workaround while patching is pending, restrict opening of untrusted .txt or similarly disguised files received via email/USB, and consider disabling Notepad as default handler for unknown file types in high-risk environments.
5. No CISA KEV listing exists, so there's no mandated remediation deadline — but monitor the MSRC advisory and CISA KEV feed for status changes, and track EPSS trend given it is currently rising.
6. Watch endpoint detection tooling for anomalous child-process spawning from notepad.exe, which would indicate exploitation attempts.

CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality/integrity/availability impact via local attack vector requiring user interaction and no privileges. Weakness is CWE-77 (command injection) — improper neutralization of special elements allows injected commands to execute in the Notepad process context. A public PoC exists on GitHub, indicating exploit maturity beyond theoretical, though not yet weaponized in observed campaigns per KEV/news. EPSS sits at 9.0% (95th percentile) with a rising trend, signaling elevated but not confirmed exploitation likelihood relative to the broader CVE population. Not currently in CISA KEV.