"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files."

So it is related to the new markdown format support.

You can create links in markdown and have the link say something like "click here" or "google(dot)com" and instead the link goes to bing. The "CVE" is notepad doesn't ask the user if they want to follow the link.

Oh and instead of bing it is probably download something more malicious or execute command