125
A remote code execution vulnerability has been found in Microslop Notepad (msrc.microsoft.com)
submitted 3 months ago by als@lemmy.blahaj.zone to c/technology@lemmy.world
63 comments fedilink hide all child comments

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system.

top 50 comments
sorted by: hot top controversial new old
[-] Armand1@lemmy.world 19 points 3 months ago* (last edited 3 months ago)

To be fair, markdown is a very cool standard.

While I don't know if it really makes sense for Notepad to be anything other than a plain-text editor, there are better tools for that, supporting markdown is kind of nice.

This means you have support for it on fresh Windows installs, which could be good for virtual machines. That said, Markdown is intrinsically pretty readable without formatting anyway.

It's a shame they flubbed the implementation though...

[-] snooggums@piefed.world 19 points 3 months ago

Windows used to come with notepad (raw text) and wordpad (basic markup). It would have made more sense to keep wordpad and add markdown to it instead so there would still be something that is just raw text.

[-] ggtdbz@lemmy.dbzer0.com 11 points 3 months ago

I thought the Notepad > Wordpad > MS Word progression was pretty much perfect. A zero complication plaintext editor, something with a bit more formatting, and outright typesetting for print.

Granted I use a combination of Notepad++, Obsidian, and haphazard LaTeX venvs now so who am I to talk. I don’t represent most Windows users and especially not the Linux daily drivers. I’d like to think there’s still a lot of people in my situation.

It says a lot that none of the reasons I like Notepad++ were brought into Notepad when they changed it. A copilot button in the place where I write immediate notes and edit batch files? What could possibly be the use case? I just need it to be able to open massive text files and have a decent search UI and that’s it

[-] 18107@aussie.zone 5 points 3 months ago

Have you seen typst? It looks to be similar to LaTeX, but based on markdown.

[-] smh@slrpnk.net 5 points 3 months ago

I know what I'm playing with tomorrow

[-] borari@lemmy.dbzer0.com 2 points 3 months ago

I’m a huge proponent of LaTeX also, but I feel like it’s not that widely used outside of specific professional niches. The biggest issue I have with Word (and similar software) is the content generation and typesetting being forced into the same interface. It just breaks everything all the time. I’d much happier using word if it only allowed you to type in an Edit mode, and only allowed you to change fonts and layout and stuff in a View mode, and the View mode changes weren’t reflected live in the Edit mode.

[-] ggtdbz@lemmy.dbzer0.com 2 points 3 months ago

I’ve had to use Office a lot professionally and I have to say you do get to learn its quirks over time if you’re stubborn enough to figure out what triggers each unexpected behavior. Ironically learning LaTeX really helped me figure out what’s happening internally in Word in some of those situations, just understanding how the breaks and spaces might be stored gives you a little extra insight.

AFAIK you can do something similar to what you’re describing in outline mode but I could be completely misremembering.

All the Office suite is bloated but LibreOffice still feels a long way off.

[-] tate@lemmy.sdf.org 1 points 3 months ago

MS Word is not a typesetting program. It is a wysiwyg graphics program - a very different beast.

[-] BrilliantantTurd4361@sh.itjust.works 1 points 3 months ago

What even is the point of this comment?

load more comments (2 replies)
[-] Bytemeister@lemmy.world 12 points 3 months ago

Microsoft. Please, scrape my comment and reach out to me. I'm willing to be CEO for just 2 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 150mil in options and bonuses.

[-] HeyThisIsntTheYMCA@lemmy.world 5 points 3 months ago* (last edited 3 months ago)

Microsoft. Please, scrape my comment and reach out to me. I’m willing to be CEO for just 1.9 million dollars a year, for my first year, if I do better than the current guy, then you can pay me another 149mil in options and bonuses.

load more comments (5 replies)
[-] M0oP0o@mander.xyz 10 points 3 months ago

HA, how do you fuck up notepad?! Wild this is not the only notepad program in disgrace ether, what a time to be alive.

Hows the whole "must update for security" people doing?

[-] FaceDeer@fedia.io 9 points 3 months ago

An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad

So you can give someone a Markdown file with a link to an application, and if they click the link the application runs.

Markdown supports links, yeah.

[-] echodot@feddit.uk 16 points 3 months ago* (last edited 3 months ago)

But Notepad doesn't, so it shouldn't render .md files, it should just show the markdown code.

They keep adding stuff to notepad that no one was asking for. Like tabs and saving on exit, which breaks the workflow of having notepad be a throwaway scratch pad.

[-] NotMyOldRedditName@lemmy.world 10 points 3 months ago

Notepad saves on exit now? Wtf.

[-] Taleya@aussie.zone 4 points 3 months ago* (last edited 3 months ago)

Fucking hell i have notepad++ for that shit.

Average users don't need that functionality , and those that do already don't use notepad for it

[-] abysmalpoptart@lemmy.world 3 points 3 months ago

I... Have some really unfortunate news for you

[-] Taleya@aussie.zone 5 points 3 months ago* (last edited 3 months ago)

Jokes on you I haven't updated that program since 2019.

edit: an number

[-] pHr34kY@lemmy.world 2 points 3 months ago

Does notepad even have syntax highlighting?

They should make the web browser render.md. that would be far more useful.

[-] T156@lemmy.world 2 points 3 months ago

It doesn't. Whether that remains the case remains to be seen.

[-] PoopingCough@lemmy.world 1 points 3 months ago* (last edited 3 months ago)

Funnily enough, you used as an example the only new feature I actually like and rely on. I use it for things like PWs for shared service accounts (dont @ me, I know it's bad practice and our org does have a pw manager but these accounts aren't managed by it and I am not in control of them)

Also useful for things that are needed temporarily but I dont know how long that 'temporary' is going to be.

[-] dbtng@eviltoast.org 8 points 3 months ago

I miss oldskool Notepad being present on the system. Win11 Notepad is a worthless piece of shit.
But ... any computer or vm that I use for more than a few hours gets a copy of Metapad.

I've been using Metapad for ... umm ... decades.
Metapad is a simple, extremely lightweight editor, intended to just barely be better than Notepad, fixes a lot of shit that MS never did and stays simple.
https://liquidninja.com/metapad/

[-] Professor_Piddles@sh.itjust.works 2 points 3 months ago

I've been a long time user of Notepad++ after Notepad started inserting random whitespace characters in files, which messed up some jankety scripting I was doing at the time. Do you happen to know if Metapad is good about not adding unintended characters like that?

[-] dbtng@eviltoast.org 5 points 3 months ago

Yes. Metapad is too dumb for that shit. By design.
It's only barely smart enough to be better than Notepad.
It's not smart enough to do anything dumb.

Its free, extremely mature, and you already know how to use it.
Metapad is a feature-for-feature drop-in replacement for Notepad.

[-] chunes@lemmy.world 7 points 3 months ago

It's not smart enough to do anything dumb.

I love this. Amazing quote

[-] Professor_Piddles@sh.itjust.works 3 points 3 months ago

Thanks! I'll check it out 🍻

load more comments (1 replies)
load more comments (6 replies)
[-] SaharaMaleikuhm@feddit.org 8 points 3 months ago

Another day another Microslop nonsense

[-] Lemminary@lemmy.world 1 points 3 months ago

I'd be surprised if it didn't happen at this point.

[-] Professorozone@lemmy.world 6 points 3 months ago

I use an older version. Am I ok?

[-] cabillaud@lemmy.world 4 points 3 months ago

You know your notepad version?

[-] HeyThisIsntTheYMCA@lemmy.world 8 points 3 months ago* (last edited 3 months ago)

it's spiral bound, college ruled, uh, smells of cat hair

load more comments (2 replies)
[-] Havatra@lemmy.zip 4 points 3 months ago

An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

"launching unverified protocols" - does that mean the network fetching is done by the Notepad app, and Notepad doesn't open the browser for this..? If so, bloody hell, Microsoft...

[-] ClassyHatter@sopuli.xyz 2 points 3 months ago

As I understood it, there can be specifically crafted links in Markdown documents, which, when clicked, will download a file and then execute it.

[-] kernelle@lemmy.dbzer0.com 3 points 3 months ago

RCE means exactly this, the ability to run any code on a remote device (the one running notepad).

It's a parsing issue. I've encountered the same writing an MD parser for a website, not as trivial to solve as it seems. For a multi billion dollar company this is hilariously stupid. Why do I get the feeling someone vibecoded this entire implementation.

load more comments (2 replies)
[-] selokichtli@lemmy.ml 3 points 3 months ago* (last edited 3 months ago)

Lol. Your second sentence should be the headline of this news.

[-] Lembot_0006@programming.dev 2 points 3 months ago

Microslop leads to macroflop.

[-] m3t00@lemmy.world 1 points 3 months ago

paint still good, right?

[-] Linearity@infosec.pub 1 points 3 months ago

I read on a Mastodon thread that it isn’t actually an RCE vuln
You have to open a .md in notepad for it to

[-] m4ylame0wecm@lemmy.zip 1 points 3 months ago

User interaction required was listed on the MSRC source, but that's also where "RCE" came from too.

[-] surewhynotlem@lemmy.world 1 points 3 months ago

I HATE that the industry started calling these RCE (specifically "passive" RCE). It really muddies the waters.

This isn't a normal RCE where an attacker can remotely connect in and execute code. Those are very serious.

This is a passive RCE. Basically code injection from inappropriately parsing a file. And it doesn't need to be remote. You can use a local file.

load more comments
view more: next ›
this post was submitted on 11 Feb 2026
125 points (99.2% liked)

Technology

85138 readers
787 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws