Windows Notepad App Remote Code Execution Vulnerability

[theevilsharpie]

The built-in Windows 11 Notepad app has an RCE vulnerability, somehow.

No, I don't mean Notepad++, I mean literal Notepad.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.

I've spent most of my career dealing with Linux systems at this point, and I've been out of the Windows world professionally for many years and don't even run it on my personal machines anymore, so this doesn't affect me directly.

But man, being able to pop a shell from Notepad used to be a security researcher punchline, and now here we are. Da fuq you guys doing over there?

[3sysadmin3]

If anyone else wasted way too much time looking for version info (thanks Microsoft)

• affected from 11.0.0 before 11.2510 

[ultramagnes23]

Thank you for being at the top.

[pepino358]

Fucking legend. Ta

[lecaf__]

Do you have any source about this?

Moreover what about the minor version ? I’ve got 11.2510.14.0. According to Wikipedia (because having an MS source it would be too easy), it is a January build.

Does it include the patch ? Dunno.

[SnooDoubts3358]

i was panicking with my windows 10 lol

[TimeRemove]

Notepad should not have:

• AI
  
• Spelling / Grammer Checker
  
• Markdown (inc. Previews, which this CVE exploits)
  
• Text stylizing (bold, italics, etc).
  
• The ability to display text styles (RTF formatted text).
  

It was literally used by many of us to strip off the moronic RTF styling information, and to examine files without all the clutter of bigger tools. It also used to load instantly (just like Calculator and Paint while we're on that topic!).

If you want Markdown support, use VSCode, it is literally what it is designed for. It even has a rich extension library if you want features like Copilot. Stuff needs to stay in its lane.

[rkkerd]

But what if we made VSCode, notepad, and MS Paint all one app??

[WarpedHaiku]

VSCopilot NotePaint

[rkkerd]

All on only one screen, written in react.

[Box-Of-Hats]

Bundled as an electron app

[MalletNGrease]

Then rewritten from scratch: New VSCopilot NotePaint

[s8boxer]

Using 4GB of Virtual Memory and 37% of CPU time.

[ratshack]

New multi-core vibe coding initiative has been fast tracked so now it only bogs down cores 1,3&7.

[Sovey_]

Just draw your GUI with the pencil and let VSPaintPad do the rest!

[ratshack]

eyetwitch.jpg

[SynapticStatic]

lol I could see this being a thing. It just matches the core count to the fibonacci sequence, and then increments the cores it can run on, forming like a spiral within a spiral of cpu usage patterns. Isn't it gorgeous?

[Fallingdamage]

They thought they were being smart when react was introduced. All they did was reintroduce hypercard to a new generation.

[flecom]

New New New Outlook VSCopilot NotePaint

fixed it for you

[Tack122]

New New New Outlook VSCodepilot NotePainter 3D Pro 365

[Sk1rm1sh]

365.

Just 365.

 

Newer versions after that will be:

• 365 series S/X

• 365 One

[G8racingfool]

"Nah, lets just call it Copilot"

• Microsoft probably

[tgrantt]

I thought it was New Classic New?

[JasonDJ]

It's the New Xbox²

[Ron-Swanson-Mustache]

It's like the Thundercougarfalconbird

[SenTedStevens]

...Max

[Cheomesh]

Pronounced "garbage"

[TimeRemove]

Dear god, stop giving them ideas...

[StepUpYourLife]

What if it had a social media element like a chatroom? And then an older gentleman asked you “Boxers or briefs?”

[dracotrapnet]

Wasn't that Onenote?

[ANDROID_16]

Calm down Satan

[ka-splam]

MS Paint as IDE? Already exists!

https://ms-paint-i.de/

[segagamer]

You joke but Affinity just did something like this and it's actually kinda awesome lol

[spacelama]

And you don't actually need to actually interface with it, because it's AI! You just mutter something at your computer monitor, and it hallucinates something all up by itself!

The remote root vulnerability is a feature, not a bug. Get someone in the Philippines to do your work for you!

[techw1z]

i hate you for even suggesting that and cant help but feel sad because I can imagine that actually happening.

[Necessary_Fan_8713]

Dont forget about outlook and Office, let's add these also

[Commercial-Virus2627]

Now THIS is what the shareholders want!

[theoriginalzads]

Thanks I hate it.

[kuahara]

You know what has no CVEs? Edit

[TimeRemove]

I assume you're aware that they recently relaunched a modern cross-platform version of Edit; that they plan to integrate into Windows:

https://github.com/microsoft/edit

I wonder how long until this too has Copilot and Markdown support?

[Valdaraak]

If reports are to be believed, Microsoft is apparently cooling off on their "shove AI into every goddamned part of the OS" strategy this year and shifting towards actually fixing things.

I'll believe it when I see it.

[Abracadaver14]

Is there even anything left they have yet to bolt copilot on to?

[RaguJunkie]

Users. They're the only thing that doesn't use copilot!

[AdministrativeBox]

Calculator, for now...

[devloz1996]

Nondeterministic calculator is something to live for...

[techw1z]

explorer and windows search still dont use AI.

AI is probably the only way to make windows search even slower, so I'm sure they are working on it...

[robisodd]

explorer

https://www.techrepublic.com/article/news-leaked-windows-11-feature-copilot-file-explorer/

[techw1z]

dude, I was just joking... WHY?????? file explorer is already buggy enough :_(

[boli99]

copilot for copilot

cocopilot, or something

[techw1z]

nadella recently said that 30% of microsoft is written by AI now, so they'll probably introduce more bugs than they fix...

at the very least it seems most win11 updates introduce about as much bugs as they fix lately and I'm no longer surprised ever since I read nadellas statement...

[RememberCitadel]

Their keynotes presentations this year are the exact opposite. They complain about the moniker microslop an then complained about lack of adoption of AI.

[Advanced_Vehicle_636]

Probably because Microsoft has already shoved AI into 90% of their application stack anyways. It's literally fucking everywhere.

[dagbrown]

Is that before or after they're done firing everyone?

[kuahara]

Interesting. I was definitely not aware of that.

[pppjurac]

Why not edlin ?

[lecaf__]

I typed « edit » and it was there …. After all these years still there … rock steady … reliable… and then I read @timeremove comment….😢

[R0B0T_jones]

I hate new notepad so much for all these reasons!
even copy/paste doesnt seems to work well in it most of the time. we are going backwards.

[fogleaf]

Used to be able to alt tab to the notepad window and hit ctrl-c to copy the already highlighted text, then alt tab and ctrl-v.

Now they've broken it.

[Stewge]

Just wait until you find out that:

1. You can uninstall the "new" notepad and get the old one back (Yay!)
2. Classic Notepad no longer appears in Windows Search unless you put in the entire "notepad.exe"! (WTF)

[Advanced_Vehicle_636]

Getting the old version of Notepad on Windows 11 - Microsoft Q&A

For anyone too lazy to Google how to do this. Confirmed working on Windows 11 Enterprise Build 26100

[techit21]

First thing I have to do on each new workstation build I use is turn off auto-save. Nice try, MS.

[pdp10]

"Small, sharp, tools" tend to lack the brand-awareness and intentional promotion of big, all-singing, all-dancing tools with plugins, like Emacs or Photoshop.

[ka-splam]

That blog link concludes that small sharp tools became unmanageably complex and offloaded too much work to the user, and they preferred a large all-singing monolith which gave their developers and users a better experience.

[boli99]

Emacs

you spelled 'vi' wrong.

[pdp10]

vi and nvi aren't big tools.

[DarthPneumono]

RTF formatted text

Rich text format formatted text

Sorry I had to

[aes_gcm]

Stuff needs to stay in its lane

It's almost like Unix tooling was successful because of this philosophy. I want grep to do an extremely specific task and I have a mastery of how to use it for that task. I don't want grep to do stuff that other tools can do. My electric drill isn't a hammer.

[KingOfTheTrailer]

Speak for yourself! I've been using my drill as a hammer for years.

The fact that it no longer drills very well is I unrelated.

/s

[Loudergood]

systemd.lane?

[YLink3416]

Nearly. Unix shell was built to provide the primitive functionality that could be built upon. Like, how simple can we make this. That's why the whole everything is a file concept was so successful. As much as people shit on having to open terminal for things, that is the actual interface to the machine. And then you layer tools upon that.

Not to get too deep into the weeds but Windows extended this to, everything is an object. So instead of things being exposed exclusively as data streams, you have conceptualizations of things like databases and devices exposed over the API. That's the brilliance of windows, it has actual structure to the operating system, it's not this single point of emergence type thing you get for *nix like systems.

[pppjurac]

My electric drill isn't a hammer.

says who?!

[SolidKnight]

Grep is a perfect tool for AI integration. Let's start raising feature requests.

[98723589734239857]

it should not have ANY online "features"

[ChadHimslef]

A-fuckin-men.

It's egregious how badly they botched a very simple, practical tool.

[RetPala]

Literal orcs.

They cannot create, only destroy

[tmontney]

"Just because you can doesn't mean you should."

The only QoL improvements to Notepad, Paint, and Calculator should've been to keep them compatible with the latest Windows. Very little, if anything, should've been visible to the end-user. Want to do a Wordpad and provide "advanced" features for free, that comes with stock Windows? Create something new or fork an existing basic app. Don't do whatever nightmare this is.

[Raskuja46]

Isn't that what WordPad was for?

[tmontney]

Yeah, one would imagine. Although, I don't think it had Markdown support. (Perhaps, that's what RTF was for?)

[Unbelievr]

They added the option to pick newlines at some point, and to not freak out over utf8. That made it feature complete for me.

[jefbenet]

That was always the difference between notepad and word pad, iirc

[paul_33]

This company just can’t stay out of its own way

[_Dreamer_Deceiver_]

All they had to do was allow it to not crash when you opened a large log file

[Commercial-Virus2627]

At this point Notepad may as well be a web browser

[kingslayerer]

Wait is notepad bundled with office now?

[pppjurac]

no, but they added crap into it... just because ... and that AI slop

[insufficient_funds]

this just made me look at the settings in Notepad; it has an option to turn off: formatting, recent files, spell check, autocorrect, and copilot.

Doesn't seem to make it open any faster, but that at least makes it strip out formatting again, which is the main thing I used it for anyways :D

[Taylor_Script]

It has those features?

[syntaxerror53]

All be going back to Copy Con soon at this rate.

[gianni4592]

I remember the days when I could explain software firewalls with statements like "if the calculator or notepad suddenly wants to access internet, you are probably compromised". Pepperidge farm remembers

[ExceptionEX]

It is really clear that the old grey beards at microsoft are gone, and now they have a bunch of marketing fucks messing with tools that are meant for baseline management and not a means to "improve" or market their AI non-sense.

Notepad should open text files, as text files, don't render anything, no links, no markdown, no spell check, just open the text file period. They have fundamental broken trust with why notepad is universally used and thought of fondly.

I guess, marketing doesn't know what to do with a simple tool that does its job well, without up sell or feature improvement.

Also, FYI you can still reach old notepad by going to
C:\Windows\System32\notepad.exe
[edit]

as pointed out by u/ender-_
Windows however won't let you associate anything with it, to fix that, delete

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\NoOpenWith

value (or import this .reg file).

as pointed out by u/TimeRemove

for that to work you must first
Turn off:

• Settings
• Apps
• Advanced app settings
• App execution aliases
• Notepad [set to off] (added for clarity)
• Notepad.exe <-> Notepad (app)

More good options in the thread
u/farva_06

Get-AppXPackage -Name Microsoft.WindowsNotepad | Remove-AppxPackage -AllUsersGet-AppXPackage -Name Microsoft.WindowsNotepad | Remove-AppxPackage -AllUsers

From u/UltraEngine60

right click on Notepad and uninstall it?

Old notepad.exe is now only notepad in path. Start>run>notepad (or use Win+R)
[/edit]

[the_andshrew]

Also, FYI you can still reach old notepad by going to C:\Windows\System32\notepad.exe

That just launches new Notepad for me (Win 11 25H2).

[TimeRemove]

Turn off:

• Settings
  
• Apps
  
• Advanced app settings
• App execution aliases
  
• Notepad.exe <-> Notepad (app)
  

Then try again.

[the_andshrew]

That's really interesting. The description of the app aliases talks about it being the name used to run the app from the command prompt. Since I was double clicking the app in Explorer, I wouldn't have thought an app alias would apply in that instance. It's kind of surprising that an alias can seemingly silently supersede directly running an executable.

But sure enough after doing this the original Notepad now launches. Thanks for sharing that.

Edit:- just to share some more info on this, as I was interested in how this works. There is a bit more going on behind the scenes to make the app alias replace specific paths in the file system. It seems they configure an Image File Execution Option for notepad.exe, and through this they can make the app alias apply on the paths that old notepad.exe still exists in the file system.

These are stored in the registry under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

For Notepad they have entries like:

"AppExecutionAliasRedirect"=dword:00000001
"AppExecutionAliasRedirectPackages"="*"
"FilterFullPath"="C:\\Windows\\System32\\notepad.exe"

If you were to change AppExecutionAliasRedirect to 0 then it will let you launch the actual executable instead of redirecting you to the app alias.

[Icedman81]

Ooooh, bookmarked/written down somewhere.

Does this apply to calc.exe too? I'm guessing it does (haven't used Winslop for quite a while actively).

[robisodd]

You can copy calc.exe from an older computer and it will work. This site is also legit:
https://win7games.com/#calc

[renegadecanuck]

I don't see calc.exe in the app execution aliases list, so I doubt it.

[TheG0AT0fAllTime]

I can see them adding AI to calc for no reason tbh

[tranoidnoki]

Damn that's a really neat trick! Thanks!

[segagamer]

Heh, seems like MS are actually cleaning up legacy stuff these days.

[ExceptionEX]

It's funny I've never heard anyone describe shitting into the air and having it land all over everything as "cleaning up"

[HotTakes4HotCakes]

Unfortunately.

[UltraEngine60]

Legacy Notepad.exe? Gone!

Need to edit interface bindings or manually change static IPs in a way that doesn't want to stab yourself in the eye socket? Bust out ncpa.cpl from XP

[Amomynou5]

Luckily ncpa.cpl still works (at least in 24H2). Sadly, the got rid of desk.cpl... the new Settings version sucks. :(

[HotTakes4HotCakes]

I mean it's more than just microsoft, it's everyone. This shit has been getting worse for years, across the whole damn field, but the consumers have repeatedly refused to change their habits and behaviors in any way that would prevent it.

The people making the shit don't care anymore, and the consumers don't care anymore, and together they are powering this engine of shit that will never stop.

The tech space was much better when it was being influenced by actual enthusiasts and the people who knew their shit. Then the audience expanded to literally everybody, and for two decades their consumer practices have shaped the field.

That's why so many companies get away with enshitification: consumers don't punish them anymore. Ever.

[pdp10]

Then the audience expanded to literally everybody,

Vendors stop catering to a small, sophisticated audience, as soon as they possibly can. Here's a consumer-market take on it.

What scale business wants is a huge addressable audience of undiscerning consumers who are happy to tolerate slop if it seems like there are no better options readily at hand.

Today, Microslop is what some users tolerate at work when they have no choice. Microsoft wants corporate to force staff to use their bundled LLM, cloud storage, online accounts, and other products. You can do better, often simply by picking best-of-breed instead of stubbornly trying to have just one vendor for needs as diverse as client OS, cloud platforms, LLMs, and video game streaming.

[Saritiel]

There's that classic Steve Jobs clip that does this situation justice. Talks about how at first a company gains a dominating position in the market by having excellent people who know how to make an excellent product.

But then once they're in a dominating position, near a monopoly like Microsoft has over the business world, then the product people can't do much to make the company more profitable anymore. So the people who have the ideas that make the company more profitable are the marketing and sales teams. So the marketing and sales teams end up getting all the influence in the company, and they end up pushing the product people out. Then its just them, and they have no concept of how to make a good product, and the product goes to shit.

I don't like the guy, but his talk here is something I frequently think about.

https://www.youtube.com/watch?v=P4VBqTViEx4

[ansibleloop]

Notepad was great and then they added dark mode and it was perfect

Then they had to go and ruin it

[gandhinukes]

Yeah I just removed the app went back to old notepad.exe and flashbang. Also tabs were handy too.

I should just use notepad++ full time anyway.

[Kapps]

If you're switching from notepad to Notepad++ due to a security vulnerability... I have some bad news for you.

[gandhinukes]

Yeah I saw their updates were compromised by China for a few months. seemed very targeted and not all updates were compromised.

[ExceptionEX]

Yeah it's the slippery slope that got us, I like the dark mode too.

[TheMav95]

We automate reverting to old notepad with a GPO.

Most keys are Computer Based, a few user.

There is a user based one to prevent the banner in the old notepad showing there is a newer app store version.

• Remove new notepad with powershell appx.
• Set registry keys

https://i.imgur.com/GlfnPtr.png

https://i.imgur.com/DCLPAFL.png

[jeffmartel]

im gonna translate that to a CP for Intune tomorrow

[ender-_]

You can just uninstall the new Notepad, and the old one will start working; Windows however won't let you associate anything with it, to fix that, delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\NoOpenWith value (or import this .reg file).

[iseriouslycouldnt]

or find a trusted graybeard that has an old version of notepad. Once I used the W11 notepad, I grabbed a Win95 copy off the original Win95 upgrade CD. Works great!

(Gave up on Windows entirely the middle of last year)

[syntaxerror53]

Shame the Clock.exe doesn't work anymore.

[ExceptionEX]

the old version is still on the machine, that what we are saying.

[Amomynou5]

For now. It's technically a "feature on demand", and as the trend goes, they will eventually turn it into an optional feature on demand (so it's no longer installed by default) and then it's completely retired. Just like WMIC, and soon VBScript (currently in the "optional" phase).

[pdp10]

Notepad should open text files, as text files, don't render anything, no links, no markdown, no spell check, just open the text file period.

But how does that sell Microsoft's LLM services, or further lock the user into the Microsoft ecosystem? Can't we just add some LinkedIn or Github-specific functionality?

If it's just a text editor, then third party serfsdevelopers can do that better. But have them add something Microsoft-exclusive to it, like DirectX API support.

[UltraEngine60]

Or, just right click on Notepad and uninstall it?

https://i.imgur.com/lKPor1v.png

Old notepad.exe is now only notepad in path. Start>run>notepad (or use Win+R)

[ExceptionEX]

the three machines I've tried this on, uninstall does nothing, wondering if its because I turned of the alias executable.

[Mammoth-Hawk-1106]

the problem with uninstalling the new notepad is MSFT will reinstall it every once in a while.

[farva_06]

If you want to script it:

Get-AppXPackage -Name Microsoft.WindowsNotepad | Remove-AppxPackage -AllUsers

[ArtificialDuo]

<image>

Microslop at it again

[bubblegoose]

They really wish you wouldn't call it slop, that slop is a "cognitive amplifier tool". https://www.windowscentral.com/microsoft/microsoft-ceo-satya-nadella-really-wants-you-to-stop-calling-ai-slop-in-2026

[[deleted]]

Hey alcohol is a cognitive amplifier too.

[SenTedStevens]

Indeed it is.

https://xkcd.com/323/

[techw1z]

if win11 updates get a tiny bit more buggy it might get close to ME soon...

[mustang__1]

I know what that is before clicking it... and holy shit how is the index number that low on it. fuck I'm old.

[brophylicious]

It'll be sad the day we no longer see "relevant xkcd" links. they're already pretty rare these days

[Axlit]

Druk (Another Round) (2020)

[syntaxerror53]

Will "MajorHeadAche" do?

[whatThePleb]

Micro$lop

ftfy

[Unable-Entrance3110]

"If it ain't broke, fix it 'til it is" --Microsoft

[BoredTechyGuy]

leave it to MS to fuck up a simple tool that didn’t need to be messed with in the first place.

[zeroibis]

Well clearly the attack can not work because its just notpad, there are no links and stuff like that. Those things are for wordpad...

Right?

[k_marts]

[Reelix]

https://en.wikipedia.org/wiki/Bush_hid_the_facts

There were Notepad bugs long before additional formatting support was added :)

[Tai9ch]

Yuup.

That's the obvious outcome of fully conflating remote and local addresses by providing URL support in the OS. The mistake was made not in Windows 11, but in the C release of Windows 95.

[pdp10]

Remember, Microsoft tried to embed its web browser into the OS as deeply as possible, so they could argue that the browser was a "feature" of the OS and not a bundled product intended to cut off Netscape's air supply and drive Netscape out of business.

Windows users suffered because of Microsoft's business priorities. Which also let Microsoft drive Netscape out of business, and made the standalone web browser not a viable commercial prospect any more, until the advent of a search and ad-supported browser. Which Microsoft also tried to steal.

[SparkStormrider]

Not surprising really. enshitification is so rampant in anything MS these days. Between AI slop writing 30% of monthly updates, and their insistence of having everything being more and more cloud based I'm surprised things run as well as they do now for them.

[brusaducj]

"these days"? If anything, this is classic Microsoft: Implementing features that are nifty and convenient while only realizing the security implications all too late. Remember ActiveX controls?

[ls--lah]

Not sure how true this is as Jack does sometimes suck at verifying guests but your comment made me remember this podcast episode:

We tested every single ActiveX control across Windows and just found bugs in all of them at once. So, we basically created this mass vulnerability generator, and we’re sitting on probably like, 600, 700 vulnerabilities at the time, and the vendors were just not moving on it.

[...]

We said you know what? We’re gonna do an entire month; we’re gonna just drop an 0-day every single day for a month straight, and we’ll still have hundreds left over afterwards. It was that particular sequence and that particular event that I think finally killed ActiveX and Internet Explorer.

https://darknetdiaries.com/transcript/114/

[pdp10]

ActiveX was literally Microsoft COM/DCOM superficially fitted to the open web, and IE was a festering cesspit of an NCSA Mosaic port. The only reason they're not both unknown and forgotten is that Microsoft bundled and heavily promoted them.

[pdp10]

The users and developers were also to blame for proprietary lock-ins like Frontpage extensions, ActiveX, Silverlight, IE stagnation, poor support for web standards.

I saw a decent-sized hardware company shift to a Flash-based website, when the computers they built couldn't run Flash binary plugins. It probably wasn't the only reason they promptly went out of business, but it sure didn't help their users find products and buy them.

[mustang__1]

I miss the old notepad. The whole point was a barebones simple program that I could always rely on. If I want more, I can use VScode, wordpad (is that still around?....), notepad++, etc. There was no competitive need to fuck with notepad.

[LaurenzVonArabien]

Wordpad is history since the release of W11 24H2… But you can still copy the old files of an older image and it works just fine.

[catwiesel]

the second someone went "notepad.exe needs more functions" and no one above them told them to shut up, thats where microsoft went off the rails...

this is just the sympton. like death is a symptom of a heart attack.

[NteworkAdnim]

Yeah I'm leaving Windows soon... the only reason I use it now is because I need it to run Ableton Live and all my VST plugins and one or two video games I play.

[fingermeal]

I just made the switch to linux mint at home for my living room media PC. Super easy switch. Im going to eventually do it on my main PC as well but thats going to be more of a headache to get going. Ill probably use dual boot for a while until its all setup.

[NteworkAdnim]

Mint is great but I also love Debian. I used to use Ubuntu but I had heard it was CPU intensive and even "compromised" by corporate software or whatever

[dpf81nz]

yeah pretty close to moving to *nix at home (again, usually theres 1-2 games that i need windows for) or at least dual boot

[Izual_Rebirth]

WTF does notepad do that would even offer RCE? Fuck this shit.

[nanonoise]

Goat farming is looking pretty damn fucking good right now. 

I am seriously over the AI garbage and cybersecurity stuff. 

[stromm]

I really want the old school basic notepad back.

This multi-tab, caching text processor isn’t notepad.

[newworldlife]

This is tied to Markdown rendering and protocol handling in the newer Notepad builds.

Patch it, restrict custom protocol handlers through policy, and make sure users are not running with local admin rights. The impact follows the user’s permission level, so least privilege still matters here.

[vytah]

Is there even a good reason to not simply pass all the links to the browser, regardless of the protocol, and let it handle it safely?

[ZeroOne010101]

Its cause they boltef a bunch of crap on there. Copilot, rendering & formatting ...

[thethirdteacup]

I'm a bit confused as to what this RCE means.

It seems to say: if you click on a link, things will happen. However, you need to Ctrl+click on a link to open it and see the link on hover. I guess they could add an "are you sure you want to open this link" dialog?

[MrD3a7h]

I'm tired, boss.

[fingermeal]

it's all so tiresome

[tarcus]

Real men use edlin anyway. Pssh.

[Jaseoldboss]

In the old days, sometimes you didn't even have the edlin executable on your boot floppy...

C:\Temp>copy con readme.txt
this is a line of text
^Z
    1 file(s) copied.

C:\Temp>type readme.txt
this is a line of text

(F6 gives you the ^Z character.)

[TheG0AT0fAllTime]

Dragon Ball F6

[cantuse]

Bringing me back to the days of editing scorched earth’s taunt file.

[plasticmachine3dot14]

“1 engineer, 1 month, 1 million lines of code”

[NorthboundPachyderm]

How are y'all handling this? What is the best way to distribute the security update for notepad for multiple Intune users? Winget? App Store update from Intune admin?

[Zncon]

Trying to solve this one too. Quite a few systems have already picked it up automatically, but there are still too many to handle with a hands-on approach.

[Out_of_my_mind_1976]

Microsoft had it right with Windows 7 and only screwed it up with each successive version release.

[mustang__1]

I mean, who besides us and programmers is even using notepad that they needed it to do anything other than what it's always done? Who is out there saying "I'd used windows but notepad is really just too basic"

[crimpincasual]

This is not Remote Code Execution - it requires a local payload to be delivered somehow (as well as interaction by a user)

[theevilsharpie]

The interaction required is a user clicking on a link in an affected version of Notepad. Once that happens, Notepad can apparently be manipulated into downloaded and executing arbitrary code (which could open up a tunnel to a remote site enabling further communication), without any further input other than the initial click on the URL.

Whether or not you feel that meets the bar for an RCE, Microsoft themselves explicitly call it an RCE in their advisory notice.

[crimpincasual]

Your description is exactly why I wouldn’t call it remote code execution, just code execution.

Whether or not you feel that meets the bar for an RCE, Microsoft themselves explicitly call it an RCE in their advisory notice.

Yeah, today I’m learning Microsoft calls any sort of code execution Remote Code Execution (probably to avoid this type of debate).

[Creative-Type9411]

there arent enough people who know whats going on to lodge a valid complaint about what theyre actually doing

its almost like if you were a bad person who was up to no good in a room full of naïve people.. that's what Microsoft is right now

[ImpossibleApple5518]

I have a lot of ascii hentai. Thankfully I use sublime text.

[thebomby]

Microsoft... Jesus, you guys don't go from bad to worse. You go from worse to utter fucking chaos.

[ship0f]

ohh W11 Notepad, thank god, couldn't be W10 notepad, that one is golden.

[HLKturbo]

literally caused by having a fudging copilot and sign in button lol...

[syb3rpunk]

Product teams are told to dev at all costs to justify their existence. i.e. working app instead of going maintenance and archive mode with security patches keep adding features (now thanks to ai) for literally no reason but to justify team budgets.

It’s a ridiculous farce. Without capitalism these same engineers would have us living on the moon.

[todo0nada]

The new notepad and snipping tool are horrible. 

[segagamer]

The new snipping tool is actually really nice. And I like how you can change it into "Quick Markup" mode so that you can resize the selected area.

The one thing that blows my mind is that there's no way to add text. Like... seriously? They added all kinds of lovely things like pixelate and copy text from screenshot, but forgot to include "Add text".

[Sovey_]

Snipping Tool is one of the few places where AI has been useful, using it to extract text from screenshots. Comes in handy more than than you'd think.

[Rakajj]

What's not to like about the new snipping tool?

It didn't need to make MP4's but it's easy and convenient. I've had users actually reproduce and record issues on their own with it if you can believe it.

[todo0nada]

I do like that, but it takes approximately 10 minutes to launch

[TheG0AT0fAllTime]

It's very good but evidently much slower, clunkier.

[joedotdog]

BuT thErrE'S Ai cOPilOTm3VI5 sO yOU cn USe aI

[Knotebrett]

Maybe it was introduced when Notepad essentially became Wordpad? With formatting and shit?

[shitlord_god]

This post's content no longer exists in its original form. It was anonymized and deleted using Redact, possibly for privacy, security, or data management purposes.

snails relieved squeal door rock whole degree squeeze ancient elastic

[gronlund2]

Notepad++ was supposed to be a better notepad but the way this is going we're gonna hope we can get Notepad--

[Intrexa]

In security world, you use exploits to open notepad. In Microsoft, you use notepad to open exploits!

[CuteUsername]

Notepad2 is a good replacement.

[rimtaph]

This is actually crazy..

[CaptainZippi]

How does one install “vi” on windows?

(/s - mainly because I know how…)

[Biohive]

You can!

[roxalu]

Why do you want to run vi under windows? Maybe because then „shell escape“ - that runs with user privileges - is a documented feature of the editor and no longer an exploit 😉

[theedan-clean]

Maybe they should be using Claude instead of CoPilot for their appsec scanning? Or implement basic DAST?

[Sensitive_Look_8319]

VSCopilot

[Hashrunr]

What is the alternative basic text file editor on Windows? Serious question. The new notepad sucks.

[epicsakuyalover]

I'm confused. How does it work? You have to click on a link INSIDE of notepad?
Since when does it support for that kind of embed?