{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20841", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-03T05:54:20.376Z", "datePublished": "2026-02-10T17:51:50.412Z", "dateUpdated": "2026-05-11T21:25:54.110Z"}, "containers": {"cna": {"title": "Windows Notepad App Remote Code Execution Vulnerability", "datePublic": "2026-02-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:window_notepad:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.2512.26.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Windows Notepad", "versions": [{"version": "11.0.0", "lessThan": "11.2512.26.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en-US", "type": "CWE", "cweId": "CWE-77"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T21:25:54.110Z"}, "references": [{"name": "Windows Notepad App Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20841", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:08.893558Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:38.005Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-11T14:53:10.118Z"}, "references": [{"url": "https://news.ycombinator.com/item?id=46971516"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://news.ycombinator.com/item?id=46971516"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-11T14:53:10.118Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20841", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:08.893558Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T18:17:40.831Z"}}], "cna": {"title": "Windows Notepad App Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Windows Notepad", "versions": [{"status": "affected", "version": "11.0.0", "lessThan": "11.2512.26.0", "versionType": "custom"}]}], "datePublic": "2026-02-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841", "name": "Windows Notepad App Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:window_notepad:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.2512.26.0", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T18:10:36.657Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20841", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:10:36.657Z", "dateReserved": "2025-12-03T05:54:20.376Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-02-10T17:51:50.412Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_notepad:*:*:*:*:*:*:*:*", "matchCriteriaId": "56B0AA8E-CC49-4C3B-949B-399BE988B00A", "versionEndExcluding": "11.2510", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando ('inyecci\u00f3n de comandos') en la aplicaci\u00f3n Bloc de notas de Windows permite a un atacante no autorizado ejecutar c\u00f3digo localmente."}], "id": "CVE-2026-20841", "lastModified": "2026-02-25T14:32:14.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}]}, "published": "2026-02-10T18:16:22.643", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://news.ycombinator.com/item?id=46971516"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.0.0,11.2510)"}}], "product": "windows_notepad", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T16:17:30.534313+00:00", "value": {"mitigation_remediation": ["Install the Microsoft patch that addresses CVE\u20112026\u201120841 through Windows Update or the Microsoft Update Catalog", "If the update cannot be applied immediately, configure AppLocker or equivalent application whitelisting to block Notepad from executing arbitrary commands until the patch is deployed", "Enable automatic updates and monitor Microsoft security bulletins to ensure timely application of future fixes"], "summary": {"action": "Apply Patch", "impact": "Local Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Microsoft Windows Notepad. No specific version ranges are supplied, so any installation of Notepad that has not yet been updated through Microsoft\u2019s security channels could be susceptible.\n", "description_and_impact": "Windows Notepad contains a command injection weakness (CVE-2026-20841) where special elements in a command are not properly neutralized. This flaw, identified as CWE\u201177, permits an attacker who may not be authenticated to run arbitrary commands on the local machine. The impact is the potential for any code to be executed with the permissions of the current user, compromising confidentiality, integrity, or availability of the affected system.\n", "risk_and_exploitability": "The CVSS score of 7.8 indicates that the flaw is high severity, while an EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The issue is not listed in the CISA KEV catalogue. Attacks would most likely occur in a local context, such as from a malicious document, shortcut, or other user\u2011initiated action that triggers the vulnerable code path.\n"}}}}, "created": "2026-02-11T21:52:12.281628+00:00", "updated": "2026-04-15T17:30:10.488272+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$windows_notepad"]}