CVE-2026-20841: Microsoft Windows Notepad

High severity, CVSS 7.8. EPSS: 9% chance of exploitation in the next 30 days.

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.

Affected products

• Microsoft Windows Notepad: before 11.2510 (fixed in 11.2510)

Published 2026-02-10. Last modified 2026-06-17.