35 ms·
Windows Notepad App Remote Code Execution Vulnerability
- consp 9mo agoSo what this means is every Windows program is now a cve nightmare (or goldmine, depending on view)?
- a96 9mo agoAlways has been.
- veltas 9mo agoYeah the other day in calc.exe I pressed F7 in programmer mode to change to octal (F5 to F8 select Hex, Dec, Oct, Bin), and instead it asked if I was sure I wanted to enable caret browsing.
- balazspapp 9mo agoI've found calc's currency converter feature frightening.
- ddtaylor 9mo agoOof. That's a special kind of stupid. I get how it happened, but like, they found a way to make calc bad while also bringing an obscure feature in modern browsers I hate with a passion. It reminds me of King of the Hill where Hank says "Can't you see you're not making Christianity better and you're only making rock music worse?"
- BLKNSLVR 9mo agoOne of the last straws that got me to migrate to Linux was how long it would take for calc.exe to open in Windows 10. Even on much older computers and much older version of Windows it was instant. Suddenly in the mid-2010's the calculator is so bloated you have to wait a few seconds for it to load? Fuck off. It didn't always take a long time to load, but often enough that it was noticeable and 'worrisome' for the future of Windows.
- dark-star 9mo agoYeah, clicking unverified links in a markdown document to launch an executable.... Clicking unknown links is always a bad idea, but a CVE for that? I dunno....
- bayindirh 9mo agoNotepad was the epitome of a single, well functioning app in Windows for the last eternity of two. Rewriting it to integrate AI and some bells and whistles recklessly and having a CVE is tragicomic if you ask me.
- muvlon 9mo agoWhat other markdown viewers or editors support URL schemes that just execute code? And not in a browser sandbox but in the same security context notepad itself is running in.
- mananaysiempre 9mo agoFunnily enough, the core Windows API here that brings with it support for every URL scheme under the sun is plain old ShellExecute() from the mid-90s IE-in-the-shell era when such support was thought reasonable. (I actually still think it’s reasonable, just not with the OS architectures we have now or had then.)
- tosti 9mo agoClicking an unknown link shouldn't result in compromise. Fortunately, MS-Windows disallows running anything not vetted by MS unless you figure out how to bypass the "SmartScreen" filter. This filter is super annoying to many a techie or gamer, but for MS-Windows refusing to run "unknown" programs is a feature, not a bug. So yes, MS will likely denounce this as not their problem and move on.
- yrro 9mo agoThis is the same company that, back in the day, warned users to not click links in Internet Explorer. A web browser.
- __bax 9mo agoJust now Notepad integrates very useful copilot assistant... What can go wrong
- g947o 9mo agoTo be fair this has more to do with Markdown than anything else. Although I approve of neither feature. notepad should stick with what it does well.
- bstsb 9mo agoi imagine it’s probably something to do with the massive scope creep recently, especially with AI and the Markdown features - they’ve tried to fit some of WordPad’s rich text features following its removal
- darig 9mo ago[dead]
- reddalo 9mo agoI miss when the Notepad was doing what the Notepad is supposed to do: show a text file, plain and simple.
- tosti 9mo agoThis was already better when the latest from MS was still called "* XP": https://liquidninja.com/metapad/ https://liquidninja.com/metapad/
- crummy 9mo agoI used to overwrite c:\windows\notepad.exe with Metapad. At some point Windows security made this a pain though!
- xnorswap 9mo agoWow that's a hit of nostalgia, I'd completely forgotten about metapad, but I loved it back in the day. And it's hard to believe now, but yes, support for Ctrl+S to save file was a notable feature because notepad itself didn't support that back then.
- barosl 9mo agoOh wow, yes I remember now, I used to type `Alt+F` and then `S` immediately because Notepad didn't support `Ctrl+S` back then. Thanks for giving me nostalgia!
- BLKNSLVR 9mo agoI've still got the very fast muscle memory of "Alt-F S", I used to do it habitually in Word and Excel. Still do it occasionally, then having to then undo whatever it does now (luckily it's usually nothing), but sometimes it leaves the Alt press 'open' so the next letter I press does something unpredictable.
- tosti 9mo ago
- rmunn 9mo ago"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files." I didn't even know Notepad would render Markdown.
- ddtaylor 9mo agoTorture will continue until morale improves
- TZubiri 9mo agoI think it's very recent, I use it almost daily and only last week did I see a markdown file being rendered.
- krater23 9mo agoThese kind of surprises are the reason why we should switch off auto update on every software.
- BLKNSLVR 9mo agoNotepad rendering other formats removes one of the specific reasons I use notepad: to strip the stupid formatting that all sorts of applications seem to want to attach to text these days. Notepad handily strips away all the custom link namings and formats that totally fuck the expected output of a simple copy and paste. That's a big part of the its magic: it's immunity to the choices of marketing teams and dud management.
- contextfree 9mo agoWindows now has buttons in win-v (the clipboard helper popup) for this
- powersurge360 9mo agoI don’t know if it works for windows but on other operating systems if you hold shift while pasting it strips the special formatting. I don’t have a windows machine readily available but I hope even if it doesn’t work there this will be useful to other people reading the comment. I agree though. Basically the only format I ever want to keep is _sometimes_ the link with text. And even then usually not the exact coloring/indicators.
- eviks 9mo agoWhat AI great job!
- jfaganel99 9mo agoNotepad had one job... Seems like bringing markdown features killed it :)
- szszrk 9mo agoMarkdown? They shoved copilot into it.
- jfaganel99 9mo agoYeah, way more than the good old Notepad :)
- TiredOfLife 9mo agocopilot has nothing to do with this vulnerability
- latexr 9mo agoSomething felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?
- greenchair 9mo agoHN is a psy-op.
- spprashant 9mo agoLooks like they logged in the first time in years to make a post https://news.ycombinator.com/item?id=46975123 https://news.ycombinator.com/item?id=46975123 And decided to jump in on some threads just as well.
- latexr 9mo agoThat post happened six hours after the comments. Doesn’t seem plausible they logged in to do it then got distracted.
- netsharc 9mo ago> An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files. From https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... (there are many collapsible elements on this page, and they're also just for term definitions, sigh) What a fucking terrible page for someone unfamiliar with the site. the "Learn More" links will allow you to learn what the terms "CWE", "CVSS", "Product Status" mean, but not to learn more about this vulnerability... Anyway, it's not related to CoPilot, but because Notepad makes links clickable now...
- fhd2 9mo ago> Anyway, it's not related to CoPilot, but because Notepad makes links clickable now... True, not related to CoPilot, but if I understand your conclusion right (which I'm not sure about), it's not _just_ that links are clickable now, it's because Notepad actually does something with the links. Otherwise it'd be a browser vulnerability, and Notepad couldn't seriously be blamed.
- LiamPowell 9mo agoIt's in fact the opposite. Browsers show a popup that asks if you really intended to click a link with a non http/https handler, notepad does not. The actual RCE here would be in some other application that registers a URL handler. Java used to ship one that was literally designed to run arbitrary code.
- fhd2 9mo agoAh, got it. Very different from where I suspected the issue then.
- Fiveplus 9mo agoWe have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"
- consp 9mo ago> viewing data is a fundamental failure of the principle of least privilege. I read the cwe not cve, was wrong. It's still early in the morning...
- seritools 9mo agoYou are mistaken: > The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.
- mwalser 9mo ago> If I read it correctly (but could be mistaken), it runs with setuid root I am certain you are mistaken. I couldn't find anything that hints at notepad running with elevated privileges.
- dijit 9mo agoPeople very often run notepad as administrator (anything launched from administrative powershell instances will run like this). In fact, if you enabled developer mode on your computer there's a registry key that gets set to run notepad as admin, it's: `runas /savecred /user:PC-NAME\Administrator “notepad %1”` in HKEY_CLASSES_ROOT-> * -> shell -> runas (new folder) -> (Default) And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it. Regardless, notepad is a very trusted application and is often run as Administrator. Often it's more trusted than any other utility to modify system files.
- dgxyz 9mo agoSeems whatever they do they step in shit. They should stop doing stuff. They spent the last few years entirely compromising their products rather than improving them.
- muragekibicho 9mo agoExactly my predicament. My laptop reached EOL but I'm struggling to purchase a new one. They're all bundled with AI features (I absolutely don't need) and never in my life will I buy a mac for coding. My current laptop is HODL'ing and idk if this enshittification will end soon.
- direwolf20 9mo agoInstall Linux
- dgxyz 9mo agoYeah it sucks. Got an MBP here which was my refuge from Windows. That's gone to hell too. I am moving off onto an old desktop running Debian stable slowly as I don't really need a laptop. This also isolates me from a number of geopolitical and technology creep and lock-in related risks I have identified.
- ddtaylor 9mo agoDo you have a moment to talk about Linux?
- w4yai 9mo agoHalf of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?
- dgxyz 9mo agoI had that problem about 20 years ago. I changed the job. I know that's an extreme position but to be tied to a steaming pile of crap is a career risk. I've seen people go down with ships in that way before and it scared me.
- voidUpdate 9mo agoI found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too
- cubefox 9mo agoIt needs far more features apparently. Tons more. That's why Notepad++ is popular. Which also had a severe security vulnerability recently. Which was actively exploited by some state actor like China.
- leduyquang753 9mo agoThat recent Notepad++ incident was a supply chain attack, not a vulnerability in the original program.
- SPICLK2 9mo agoStrictly, no. But it was a vulnerability in the design of Notepad++, key elements here being the featureset that requires frequent updates and the lack of integrity checks during the upgrade process. This has prompted me to move on from Notepad++ - it's sad, because I've used it for many years, but this is too much.
- IsTom 9mo ago> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.
- RobotToaster 9mo agoPretty sure winget does let you do that.
- 9mo ago
- kuboble 9mo agoI used notepad as my default, simple text editor for ages. After they added copilot I finally gave up and uninstalled it and switched to a one of the minimalistic clones of the good old notepad.exe
- r2vcap 9mo agoA few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…
- dgxyz 9mo agoWell technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.
- direwolf20 9mo agoUnixes like Linux are not immune.
- nananana9 9mo ago"Fine" Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc/ when literally the only files that matter to me are in /home, which is a free-for-all?
- dgxyz 9mo agoThe first point is fairly obvious and the latter point is not true (AppArmor etc)
- DobarDabar 9mo ago[dead]
- idoxer 9mo agoWe got notepad.exe RCE before GTA 6
- hdgvhicv 9mo agoSo notepad now renders links, then when clicks execute the code on those links (not just loading a website in a browser for example)?
- ankurdhama 9mo agoMy assumption here is that if the link is web link it will open that link in web browser but Windows (and other OSes) have custom URL handlers that open whatever app is registered for that URL and that app may have issues that causes it to download and run arbitrary code.
- colinsane 9mo agoWindows and other OSes have application launchers that open whatever app you want, and those apps may have issues that cause it to download and run arbitrary code. if that's the logic here, then every application launcher is vulnerable to similar RCE. if there's really nothing more to this 8.8 RCE CVE than that, this will finally be the thing that's makes me blackhole cve.org.
- 0xmattf 9mo agoI'm at work, on a work computer, so can't fully test, but yes. I saved this as test.md, opened it in notepad, clicked the link, and it popped open a command line: [Click me](C:/Windows/System32/cmd.exe) Can definitely go further than this; just a quick test. To be fair, though, it's not just a click -> open/run. The user has to `ctrl+click` and will see the source of the link (at least I do).
- eur0pa 9mo agoGood job!
- avaer 9mo agoYou can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows. This isn't an AI slop problem.
- egorfine 9mo agoTools are almost never the problem. The application of tools is.
- avaer 9mo agoI 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out. There must be something much worse than slop going on to get to this point.
- szszrk 9mo agoNotepad and mspaint have now copilot integration. With full authentication integration that will likely fail for people in corporate environment. That's a slop if you ask me. Even if it wasn't vibe coded, it now want's me to vibe use it. Who the hell wanted that.
- deaux 9mo agoIt's good ole enshittification, which became common at least a decade before the term vibe coding was coined.
- d3Xt3r 9mo agoWhat most people don't realise is that this enshittification has been ongoing since a long time, about the time of Windows 8 and the introduction of "Metro"/UWP apps. The Control Panel was the first victim - replaced by the shitty Settings app which we saw in Win10. But along the way, MS have been slowly replacing the good ol' small and fast win32 apps with highly bloated UWP versions. It's not just Notepad now, every core Windows app is a UWP app. People don't realise how much bloat this is. The new Snipping tool for instance is 449 MEGABYTES, whereas it used to be only a few KB in size. Same with Paint, Calculator etc - all bloated UWP apps. UWP was a mistake, they should've stuck to win32, at least for core apps.
- yellow_lead 9mo agoI'd now like to see a RCE in MS Paint or Calculator, if the exploit finder is reading this.
- st_goliath 9mo agoUp next: forgotten Piet[1] autorun feature discovered in MS Paint. Customers complain after removal, insist they have existing legacy applications depending on it. [1] https://en.wikipedia.org/wiki/Esoteric_programming_language#Piet https://en.wikipedia.org/wiki/Esoteric_programming_language#...
- larodi 9mo agouse SublimeText, it is perhaps faster now than the stock Notepad
- Krssst 9mo agoCombined with LSP I find it to be quite a good IDE too. Handles extremely large source trees quite well.
- outime 9mo agoI can definitely vouch for this! I've been using it for many years and it's been essentially the same the whole time: fast, lean and working on all operating systems.
- xnorswap 9mo agoAs much as I used to love Sublime, the version switching caught me out which burned me a bit, even if admittedly my v2 key lasted an unreasonable time through the version 3 beta, but I don't want to risk buying a v4 key without a clear roadmap of when they might switch to version 5.
- skydhash 9mo agoIt’s $99 for something that is almost 5 years old at that point.
- bigstrat2003 9mo agoThey changed how that works. Licenses are no longer tied to version, you get 3 years of updates no matter what the version is.
- lpcvoid 9mo ago8.8 RCE CVE in notepad.exe. Well done microslop
- j1000 9mo agouse linux
- repelsteeltje 9mo agoI'm frankly amazed that the majority of new laptops still come with Microsoft Windows. To be fair, over the years there have been sincere efforts to re-architect the OS with a security, privacy, reliability for peristent storage, graphics, multi-tasking, multi-user, networking etc. But those efforts never caught up with the speed at which bloat was added. At the heart, its design still has remnants that have the naivety of a stand-alone, stateless microcomputer that boots straight off a floppy after BIOS POST.
- chrisjj 9mo ago> Product > Windows Notepad Disambiguation urgently needed.
- core1024 9mo agoIt looks like, after Microsoft discontinued WordPad, they want to implement more features into Notepad. If you want simple plain text editor you have to use msedit[1]. [1]https://github.com/microsoft/edit https://github.com/microsoft/edit
- feverzsj 9mo agoThey could've just implemented it in webview2 with all the AI features they want.
- mjmas 9mo agoIt is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.
- BLKNSLVR 9mo ago> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/ https://www.snopes.com/fact-check/car-balk/
- Hackbraten 9mo agoUnpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.
- nottorp 9mo agoExcept notepad was the safe option for editing files and making sure what you see is what gets saved. Not any more?
- hulitu 9mo agoNot. They want it to be Notepad + Wordpad and, in the future, Wordstar.
- PlatoIsADisease 9mo agoMaybe I don't understand what markdown support will imply, but doesn't this hide text? Like, if I have a h2 or url, its going to show as special text rather than the h2 tag?
- richardfey 9mo agoI feel like the process of carving out any meaning out of "QA" is complete. It's cathartic, in its twisted way...
- jmyeet 9mo agoI found a simpler explanation for what's going on [1]. To summarize, malicious Markdown files with custom schemes in URLs can trick users into executing arbitrary code. I honestly didn't know this was a "feature" of Notepad. I guess that's my real problem here. The constant desire for feature bloat inevitably introduces potential vulnerabilities. In no world did I expect Notepad to have the ability under any circumstances to make network requests and execute arbitrary code. Nor should I. As an aside, this is why I violently despise Eletron apps and anything that runs its own browser engine for a GUI. I just don't want that level of attack surface in any app that I use. [1]: https://cybersecuritynews.com/windows-notepad-rce-vulnerability/ https://cybersecuritynews.com/windows-notepad-rce-vulnerabil...
- ruhith 9mo ago[dead]
- naikrovek 9mo agoIn the past I would have defended Microsoft for this, somehow. The Microsoft of 2026 is insane and I have 40,000 ideas to improve things without being anticompetitive but I no longer want to work at that company for any amount of money. Microsoft have been stagnating and letting business people steer product direction for about 30 years too long. MBAs don't know shit. Stop letting them lead product direction. Stop letting people who are not power-users of a product make decisions about that product. PERIOD. No more PMs who aren't advanced users who lived in the tool 8 hours a day for months in a previous role. Promote people who think differently, ESPECIALLY IF THEY DO NOT FIT IN THE CULTURE AT MICROSOFT TODAY. Think about ways to innovate. Advance the computing landscape, god dammit. Why are terminals still textual? How the fuck have we not moved past this ancient paradigm? Look at Plan9 and adopt features that Plan9 pioneered, and pay zero attention to what customers will accept while doing it - you can change the shape of these features to make them palatable at a later stage of design (there's no reason these features need to be painful for anyone, but they can be--and should be--very secure and inherent, rather than opt-in.) Just pull your flippin' head out of your ass, Microsoft. Holy shit.
- Stevvo 9mo agoOld notepad is still in Windows 11 at C:\Windows\notepad.exe
- petee 9mo agoWorks great still, but now windows won't let me associate .txt files with it. God damn I hate the future
- 1970-01-01 9mo agoftype txtfile=c:\windows\NOTEPAD.EXE %1
- petee 9mo agoI can successfully set that as admin, but it doesn't change anything - file won't open and "open with" pops up an error still that notepad can't be used. Edit: going with EmEditor; forgot that existed
- xaldir 9mo agoAnd they even put a nagware in it to point you to the new notepad. Oh MSFT.
- 31337Logic 9mo agoActually, the big red flag for me was the removal of "My Computer". Folks, you might still think it's "your computer" but Microsoft clearly doesn't. You've got something they want and they will stop at nothing to take it from you. This should be treated as an all-out war.
- deleted 9mo ago[deleted]
- Fuggin 9mo ago[flagged]
- ubixar 9mo agoNotepad had one job, display text. Microsoft decided it needed an attack surface instead. The year of the Linux desktop doesn't need to arrive - it just needs Windows to keep shipping.
- vachina 9mo agoMore like the year of the Mac OS (or MacBook). Once market saturates with cheap M series you will see everyone switching.
- tyiz 9mo ago[dead]
- dkga 9mo agoOne of the (not so many) things about Windows that I loved was the zen simplicity of the Notepad. I saw it through Windows 3.1 all the way to the bloated oblivion it was driven to, and I did not like to see that sad, final chapter. (Broader theme, do I miss the simpler computer times!)
- reactordev 9mo agoAs if you needed another reason to switch to Linux
- nu-world-odor 9mo ago[dead]
- phendrenad2 9mo agoMicrosoft is stuck in exactly the same situation Linux is: It has to be all things to all people. It has to be simple enough that grandma can use it, but powerful enough to not alienate their business customers. Putting link-handling (rich text) in Notepad (the plain-text editor) was idiotic, however.
- anthk 9mo agoIf you can use Reactos' Notepad.exe from the daily ISO build (extract reactos.cab with 7zip) the better.
- VagabundoP 9mo agoBare with me, but im not again' the new Notepad. Its fairly well done - the markdown - and even the AI dropdown presets seem useful. but I do wish they had called it something else and kept notepad as txt only.
- deleted 9mo ago[deleted]
- self_awareness 9mo agoThis wouldn't happen if they'd use more LLM models to triple-check what previous models did during development!
- mococa 9mo agoConglatulations Microslop.
- 1970-01-01 9mo agoLet's ask the obvious. There should be zero vulns in notepad. It should be feature complete since XP. Who approved this vulnerability, and how quickly can they be fired? The App store is a joke. At least call it Notepad 2.0 or some other flashy garbage so we can proactively label the bullshit as such.
- ufos1111 9mo agoNotepad completely froze up on me the other day, from just closing tabs of text files. It's so bloated its a complete joke, it should be nothing more than text editing, get rid of all the nonsense added to it since win11
- gkcnlr 9mo agoBy looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...
- Culonavirus 9mo agoMicrosoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.
- bigbuppo 9mo agoThis is why I have been saying that Microsoft is about to go the way of Sears when the AI bubble pops.
- smegger001 9mo agoI don't know about that they have multiple successful businesses with or without AI and they stand to have all of OpenAI's IP when they implode (their license gives them free access to fork all of OpenAI's AI models with the sole exception of some hypothetical future artificial general intelligence) my guess is they take a hit to the stock price but so will everyone else and they will go on a shopping spree of buying up any IP or infrastructure left after the bubble pops.
- hnlmorg 9mo ago> Microsoft is Windows. Anyone saying otherwise is completely delusional. What's delusional is making an unsubstantiated claims and then dismissing any counterarguments before they're made. > Most of M$ office software has alternatives (Google Docs, OpenOffice...) True. Yet MS Office is still the de facto standard. > Github is constantly crashing and burning True. But that doesn't mean it isn't still a business strategy for MS. > Azure is garbage Also true. But that doesn't mean it isn't profitable: "Microsoft Cloud revenue increased 23% to $168.9 billion." > and they uttery killed Xbox Quite the opposite. Xbox is thriving: "Xbox content and services revenue increased 16%." > Oh and Linkedin is for actual psychopaths. That's subjective. And even if it were true, that's got nothing to do with profitability (eg look at Facebook). > If Windows dies, all of their other junk that is attached to the platform will die as well. First off, literally no-one is claiming Windows is going to "die". Secondly, even if it were to "die", you've provided no evidence why their other revenue streams wouldn't succeed when it's already been demonstrated that those revenue streams are growing, and in some cases, have already overtaken Windows.
- wisplike 9mo agoHow are these discovered? Is it just a well informed guess or do people decompile these programs?
- d3Xt3r 9mo agoCan't speak for others, but this one is a fairly obvious vulnerability for someone who's in this field - similar bugs have existed back in the day in web browsers, and even somewhat recently on other platforms like Android (messages app) etc. Basically anything that displays clickable links, or renders web content etc - there's a high probably of there being a vulnerability, you just need to test a few well-known scenarios (and there are automated test suits for these things too). The moment Microsoft started adding crap to Notepad, we knew that it was only a matter of time before such a vulnerability cropped up.
- alihawili 9mo agoDuring Windows millennium days, I accessed internet mainly from internet cafe's, most of them had windows restrictions enabled, with downloads disabled, my computer hidden and such. Open notepad, and from notepad I access USB drive then run opera browser installed on it. mail, web, downloads..
- docmars 9mo agoHow's that vibe-coding going, Microsoft? You replaced a perfectly good text editor with AI slop and this is the result — who could've predicted that?
- deafpolygon 9mo agoGuess vibe-coding the notepad with AI didn't really do them any favors.
- jiggawatts 9mo agoFor Linux folks: Notepad is the Windows equivalent of a console editor such as Pico or Vi. Its job is to be robust, simple, and always available. It's supposed to show you the symbols in markdown, not render them. It is useful for opening potentially dangerous content in a 100% safe way, because "txt" should always be safe to inspect! It is regularly used to open gigabyte-sized log files and the like, which it has to handle on machines with less free memory than that! Markdown rendering and similar features are fundamentally incompatible with this requirement because they require serialised parsing of the entire file instead of opening just tens of kilobytes at a time using memory mapping or whatever. Notepad is also used to open files without taking a lock, allowing users to read files that are actively being written to. Again, incompatible with practically all parsing strategies. The "new Notepad" is some dumbass executives pet project that overlaps with Visual Studio Code and is a shitty alternative to WordPad, which another dumbass executive axed for no good reason.
- contextfree 9mo agoIt doesn't do any markdown parsing unless you specifically open a .md file
- jiggawatts 9mo agoIt should never do any kind of parsing for any kind of file, irrespective of the file extension! It's supposed to be a basic text file viewer / editor, not an alternative to WordPad or VS Code! Not every app has to be everything for everybody. We're in an era now where Calc.exe takes appreciable time to start and pops up HTTP web proxy authentication prompts on some networks. It's just incredible to me the level of enshittification people just shrug off like it's nothing. Just now, I'm trying to debug something in Visual Studio 2026. The debugger's "view list" control takes over 10 seconds to pop up a simple table of text. Text! Tens of seconds! On a gaming/workstation PC! Nobody at Microsoft thought this was a problem.
- nu-world-odor 9mo ago[dead]
- grougnax 9mo agoAt this point Windows should just be thrown to the trash already
- SV_BubbleTime 9mo agoMeme aside, I’ve honest seen more people switch to Linux this year for “windows really sucks now” reasons than ever before. I was there last year myself. Decades of “eh, it’s not that bad” to “nope no, no fuck this”.
- Falkon1313 9mo agoI still don't understand this one. Yes, clicking a link can trigger what it's linking to. That's the entire concept of links. You can also put a shortcut to a program on your desktop and - horror of horrors! - clicking the shortcut will execute the program! How crazy is that? I get that some people don't want the markdown functionality in notepad (you can turn it off very easily, btw). But I don't understand why suddenly the idea of hyperlinks is being blasted as a terrible security vulnerability? Surely there has to be more to this, in order to generate so much hubbub, than just people not understanding the basic concept of hyperlinks?
- LocalH 9mo agoFrom what I can tell, this isn't RCE at all