CVE-2026-20841

PoC ×2—

CVSS 3.1

7.8 high

EPSS

12%p96

Published

Feb 10, 2026 (Feb 10, 2026)

Modified

Jun 17, 2026

Description

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.

Vendors: microsoft
Products: windows notepad
Weakness: CWE-77
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (11.8%)

In the news4 stories

Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience

Help Net SecurityFeb 15, 00:00 UTC · Feb 15, 2026Vulnerability in the wildCVE-2026-1731 CVE-2024-12356 CVE-2026-1281+2 CVEs

Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities

Cisco TalosFeb 10, 23:54 UTC · Feb 10, 2026Vulnerability in the wildCVE-2026-21522 CVE-2026-23655 CVE-2026-21525+12 CVEs1

Windows Notepad Markdown feature opens door to RCE (CVE-2026-20841)

Help Net SecurityFeb 20, 11:02 UTC · Feb 20, 2026Vulnerability CVE-2026-20841

ThreatsDay Bulletin: AI Prompt RCE, Claude 0-Click, RenEngine Loader, Auto 0

The Hacker NewsFeb 15, 00:00 UTC · Feb 15, 2026Vulnerability CVE-2026-20841