Only Microsoft could put an RCE in a basic text editor
...OK, I'm sure that Vim with umpteen plugins could do the same, but those plugins are optional.
What an absolute mess of a company.
Steven R
Notepad's new Markdown powers served with a side of remote code execution
Just months after Microsoft added Markdown support to Notepad, researchers have found the feature can be abused to achieve remote code execution (RCE). Tracked as CVE-2026-20841 (8.8), the vulnerability was addressed in the Windows maker's most recent Patch Tuesday fixes. The flaw misses out on the top severity scores as it …
-
Wednesday 11th February 2026 11:43 GMT Doctor Syntax
Sheer lunacy
FreePascal/Lazarus, a TMemo object, open and save dialogs, a menu and/or a few buttons with a few lines of code to join itall together (or the equivalent in your IDE of choice) would be enough to make a basic text editor which is likely to be what most people would want.
Now we need remote processing.
-
-
-
-
-
Thursday 12th February 2026 10:32 GMT Graham Cobb
Re: Sheer lunacy
Function keys? FUNCTION KEYS??!!!
My ASR33 ain't got no g*dd*mn FUNCTION KEYS!
I queued overnight in a street under the arches of Kings Cross station in about 1977 to buy a real, very heavy, second hand teletype in a sale. There were about 50 of us queuing all night, with thick coats and sleeping bags, to get the bargains - not just teletypes but all sorts of secondhand business electronic gear.
Fortunately I only had to place the order then: I didn't have to take the thing home on the train.
-
-
-
-
-
This post has been deleted by its author
-
Wednesday 11th February 2026 13:20 GMT lglethal
I've got an idea...
Listen guys, hear me out. We've been getting some feedback that some people, crazy people clearly, are not soooo happy with the new changes to Notepad. But look I have an idea.
We split Notepad into two programs. Wait, wait, just listen. Right, one, lets call it Notepad Classic, rips out all the new stuff and takes it back to being just a simple stupid word editor. Right, right, no listen, really that is what some people want. And then we take the second program and add in all that new stuff, plus any other great idea you guys come up with. And to differentiate it a bit more, we'll give it a new name, something between Notepad and Word... I've got it Wordpad! Yep we call that one Wordpad. And that one gets stuffed to the gills with all the cool features. Once we've done that, well we can dump the whole Classic from the name Notepad, and just have Notepad and Wordpad!
I know, I know, it's a radical idea. A bit out there. Creating two programs, but you know we have 2 separate audiences here, and one size does not always fit all. Not everyone can wear my shoes, you know what I'm saying. So 2 programs, for 2 different audiences. Crazy, right? But you know it might just work...
-
Wednesday 11th February 2026 14:58 GMT Charlie Clark
the app's core ethos as a lightweight, fast, no-frills program…
This is bollocks, it was developed to showcase MFC and wasn't supposed to be shipped with the OS because it's limitations were known to developers. Even then there were other, better text editors that didn't mean you had to join the sects of either Emacs or Vi.
-
Wednesday 11th February 2026 15:06 GMT Anonymous Coward
Re: the app's core ethos as a lightweight, fast, no-frills program…
> it was developed to showcase MFC
Yet it was shipped before MFC, by - years. Neat trick. According to Microsoft, years before they even released their first C++ compiler!
> wasn't supposed to be shipped with the OS because it's limitations were known to developers
What limitation?
Classic Notepad was a perfectly functional little editor. It did its job and nothing else. Which is why so many people regret its passing.
> Even then there were other, better text editors that didn't mean you had to join the sects of either Emacs or Vi
Yes, there were - and are - other editors with many more functions. And plenty of other small, compact, simple editors, usually on the same machines as the full fat ones. What of it? Plenty of comments here are from devs who use huge editors, full IDEs even, but still want to have Notepad around.
-
-
-
Wednesday 11th February 2026 17:28 GMT paluster
Re: the app's core ethos as a lightweight, fast, no-frills program…
You have to remember that modern day scripts cant actually write scripts.
I accept your point about hand coding HTML back in the Jurassic era, I did it myself and the simpler the editor the bettet.
Notepad really did the job for admins because every good admin knows that if you have to do things repeatedly you put the commands in a shell script, regardless of what OS yiu are using. I've done that on two different mainframe systems, Solaris, Linux and Windows Server over the years.
-
Thursday 12th February 2026 10:33 GMT Charlie Clark
Re: the app's core ethos as a lightweight, fast, no-frills program…
No, never. It would be awful for HTML. I think the last time I ever did anything with it was to look at some XML credentials. Back in the day I used the command line editor often enough, which was much easier to work with.
-
Wednesday 11th February 2026 17:13 GMT BartyFartsLast
Re: the app's core ethos as a lightweight, fast, no-frills program…
If I wanted to experience pain I'd push staples under my fingernails, I'd not try creating or editing megabytes or even hundreds of kilobytes of code in notepad unless there was absolutely no alternative.
notepad was absolutely great as a quick n dirty tool for editing text files which don't need any of that bollocks, batch files, ini files, cmd etc.
-
-
Wednesday 11th February 2026 23:08 GMT Anonymous Coward
Re: the app's core ethos as a lightweight, fast, no-frills program…
Oh, you haven't had the latest fad rammed down your throat? That is to write every log file into the application database.... what a fucking stupid idea. It almost like some C-level manager have a vested interest in companies like Dynatrace, New Relic, and AppDynamics.
-
-
Wednesday 11th February 2026 18:10 GMT that one in the corner
Re: the app's core ethos as a lightweight, fast, no-frills program…
> Limitations: let's start with encodings and line-wrapping
You want fancy features, you use fancier programs. Like Wordpad! Neither of those items are important in so many cases, including knocking out a quick batch script or C program, if you are working on someone else's box and they haven't installed *your* choice of big complicated editor.
Doubly so at the time Notepad was first released, when you claim that the devs at MS didn't want it released... MSDOS times.
-
-
Thursday 12th February 2026 14:32 GMT Tron
Re: the app's core ethos as a lightweight, fast, no-frills program…
Yes. I use it for that all the time. Copy text from a webpage with a tonne of formatting, Paste it into Notepad. Copy it, and you can paste it into whatever you are using, minus the formatting BS. Saves a lot more time than AI ever will.
If you want something a bit fancier, there is NoteTab Light.
-
-
Wednesday 11th February 2026 17:19 GMT Bebu sa Ware
Re: the app's core ethos as a lightweight, fast, no-frills program…
Yet it was shipped before MFC, by - years. Neat trick. According to Microsoft, years before they even released their first C++ compiler!
Yes I am fairly certain the source code was example C code shipped with the Windows 2.0 or Windows 3.0 SDK. I was working with Zortech C/C++ 3.0 partly because MS didn't have C++ compiler and Zortech was the only actual C++ compiler that could produce Windows .obj code directly - the other products were preprocessors (à la CFront) to Windows capable C compilers (eg MSC 4.0) and most were unbelievably expensive (eg Glockenspiel ?)
From what I recall the Notepad application was a thin layer above the the native Windows text window abstraction.
Mercifully MS and I permanently parted rags soon after that. Sun workstations were a lot more fun. :)
-
Wednesday 11th February 2026 17:34 GMT captain veg
Re: the app's core ethos as a lightweight, fast, no-frills program…
> From what I recall the Notepad application was a thin layer above the the native Windows text window abstraction.
Correct. Just an edit control with the ES_MULTILINE style and some menus that sent it various EM_ (and WM_) messages. Almost nothing to it -- which is what made it great.
-A.
-
Wednesday 11th February 2026 18:55 GMT Ken Hagan
Re: the app's core ethos as a lightweight, fast, no-frills program…
So much so that MS should just have added support for UNIX-style line breaks to the standard edit control and let Notepad inherit that.
But what they are more likely to do now is add Coprolite support to that control and revert to the original Notepad implementation. Sigh...
-
-
-
This post has been deleted by its author
-
-
Thursday 12th February 2026 12:50 GMT Roland6
Re: the app's core ethos as a lightweight, fast, no-frills program…
Yes there are better (Windows-based) text editors, however, they are not bundled with Windows and installed by default. Ie. The admins have to deliberately write scripts to remove Notepad.exe from a Windows installation.
It is a similar story with Unix, there are better editors than ed and vi, however…
With Linux obviously, much depends upon which particular distribution you use, however Vim and Nano seem to be always bundled.
-
Thursday 12th February 2026 16:06 GMT AndrueC
Re: the app's core ethos as a lightweight, fast, no-frills program…
It is a similar story with Unix, there are better editors than ed and vi, however…
And even if you find yourself on a dumb terminal for which the OS doesn't or can't have cursor control at least you still have the ex command set available from within vi.
-
-
-
Wednesday 11th February 2026 16:25 GMT MattieD
There's Edit
On Windows 11 (and maybe Server 2025, I've not got one to hand to check) they've reintroduced Edit. Which for those of you older than God's dog will remember from back in the MSDOS days. It's how Notepad should be - just a simple text editor. It even supports mouse-clicks for the menus for those too chicken to use a keyboard shortcut.
-
-
-
This post has been deleted by its author
-
-
Wednesday 11th February 2026 22:08 GMT O'Reg Inalsin
Ask the fly on the wall who saw the feature being developed
Markdown is a general term to describe a family of text formats that generally have these properties
1. It's mostly already readable in its text form
2. each MD format may have one or more converters to render HTML (or similar)
Generating HTML with external inputs is an inherently dangerous practice - not just for MS, as this github page describes - Markdown's XSS Vulnerability (and how to mitigate it).
That page concludes - So, is it all lost? Not really. The answer is not to filter the input, but rather the output. After the input text is converted into full fledged HTML, you can then reliably apply the correct XSS filters to remove any dangerous or malicious content.
Yet the bug MS describes goes further - Attacker needs only to get an unwitting user to open a Markdown file in Notepad and click a malicious link embedded inside. According to Microsoft's explanation, a hacker can exploit the vulnerability to launch "unverified protocols" that load and execute files with the user's permissions. That's another level of permissiveness altogether.
I don't think any mainstream browser would allow execution in the host environment, or even allow saving a file without a message box confirmation. Somebody must have built that feature into Notepad deliberately. It's either 20th century level of naivety, or a nation state plot, or both.
-
Thursday 12th February 2026 00:05 GMT Anonymous Coward
Re: Ask the fly on the wall who saw the feature being developed
> Somebody must have built that feature into Notepad deliberately. It's either 20th century level of naivety, or a nation state plot, or both.
Many, many, so many of Microsoft's recent patches and their associated bugs (fix a security vulnerability by .... pre-creating a directory?) reek of LLM-coding, and lack of intelligent review. This one, too.
-
-
Thursday 12th February 2026 09:38 GMT Anonymous Coward
Once upon a time
Once upon a time, I needed a simple text control, wrote it, had fun, and was happy. Then I wondered whether I could package the control into an app, did that, had fun, and was happy. The I wondered whether I could make the app international, translated it into ten languages, had fun, was happy. Then I wondered whether I could publish the app into the microsoft app store, made a web page, wrote privacy statements, uploaded and certified the app, had fun, and was happy. The app was still very simple, no bells, no whistles, and no bugs. The app was free and it was downloaded and used around the world - not often but on most days. I am not sure why anyone needed a simple text editor, but I had fun, and I was happy. Last year, microsoft removed the app from its app store. The report said: "Your product must offer unique lasting value, such as interaction and variety. Content offered provides little value or variety."... and I lived happily ever after.
-
Thursday 12th February 2026 10:22 GMT Dwarf
Settings
I was poking around in Notepad the other day, as I had to use it as NP++ wasn't installed. I found that there are some settings now under settings (cog icon), top right, which allows some of the crap to be turned off, including Word wrap, formatting, not re-opening everything when you re-open the apps, discarding previous session, no spellcheck, no auto correct, no copilot.
Each setting is obviously defaulted to on, which is generally not what you want. Its all very much Wordpad lite now.
I'm also left wondering who the target user base would be for this monstrosity - given that they are driving everyone towards Office 345 and anyone with half a brain will be installing one of the Open Source alternatives if they actually want to write docs for free.
Bring back notepad. Simple, like it should be.
I wonder if Microsoft could publish a simple paper about what their expected use cases are for all the overlapping products that can edit stuff.
-
Thursday 12th February 2026 16:31 GMT SamanthaFA
I'm reminded of a tale from not long after the great Humphrey Lyttelton passed away - in a tribute programme Jeremy Hardy told the story of being on tour for "...Clue", staying in a hotel somewhere in the UK, sharing a table with Humphrey for breakfast.
when Humphrey's order arrived he looked at it for a minute, and then with a big sigh said "Prunes....how in the world do you fuck up prunes?!"
right now if Microsoft was a chef, I wouldn't trust them to boil me an egg :-(
