Microsoft is reportedly working on yet another "advanced" Notepad feature that has little to do with basic text editing.

Microsoft patches CVE-2026-20841, a high-severity Windows Notepad flaw that could allow code execution via malicious Markdown ...

Notepad has quietly evolved over the past few years, and image support could mark its biggest shift yet, especially after Microsoft removed WordPad from Windows and left a gap for richer editing.

Microsoft continues to move Notepad away from its text-editing roots with planned support for images. Although not officially announced, an image icon has appeared on the Notepad toolbar for Windows ...

PCWorld reports that Microsoft is adding image support to Notepad, bringing a feature previously exclusive to WordPad to the basic text editor. The update includes a dedicated image button in the ...

Users could be tricked into running arbitrary code, but the issue was patched last week.

Microsoft’s effort to modernize the humble Notepad app has come with a cost: Security researchers have discovered a serious vulnerability in the program following a feature update. The flaw, which ...

Microsoft patches Windows 11 Notepad RCE flaw CVE-2026-20841 Vulnerability exploited Markdown links to execute malicious code with user permissions Patch Tuesday update fixes issue; versions 11.2510 ...

TL;DR: Windows 11's Notepad app has a security flaw rated as a 'high' severity vulnerability, one that allows for remote code execution. The good news is that it's already been patched by Microsoft, ...

Last year, the creator of Notepad++ rolled out an update for the text and source code editor after security experts reported that bad actors were hijacking its update mechanism to redirect traffic to ...

Notepad++ targeted in sophisticated supply-chain style attack via compromised hosting server Attackers delivered tainted updates to select victims, exploiting weak update verification controls Breach ...

Notepad++ reported that its built-in auto-update feature had been hijacked by Chinese state-sponsored hackers from June to September of 2025, and the credentials gathered by the bas actors enabled ...