CVE-2026-20841
Published: 10 February 2026
Summary
CVE-2026-20841 is a high-severity Command Injection (CWE-77) vulnerability in Microsoft Windows Notepad. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Windows Command Shell (T1059.003); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-20841 is a command injection vulnerability (CWE-77) affecting the Windows Notepad App. Published on 2026-02-10T18:16:22.643, it arises from improper neutralization of special elements used in a command, enabling an unauthorized attacker to execute code locally. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Exploitation requires local access to the target system (AV:L) with low attack complexity (AC:L) and no privileges (PR:N), but user interaction is necessary (UI:R), such as opening a specially crafted file in Notepad. A successful attack allows arbitrary code execution locally, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the same security scope (S:U).
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841. Further discussion appears on Hacker News at https://news.ycombinator.com/item?id=46971516.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7307
Vulnerability details
Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-77) in Notepad directly enables OS command execution (T1059.003) upon user opening a crafted file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-20841 by requiring timely identification, reporting, and patching of the command injection flaw in Windows Notepad.
Prevents exploitation of the command injection vulnerability by enforcing validation of information inputs, including special elements processed by Notepad.
Mitigates the impact of arbitrary code execution from the command injection by protecting system memory from unauthorized code execution.