Extra features for Windows 11 Notepad go beyond worries about bloat, as new security flaw shows

Windows 11's Notepad app is slowly becoming WordPad, after Microsoft ditched the latter, and made up for that (in a fashion) by adding quite a few extra features to the former - but one introduction has ushered in a security vulnerability.

2

This highlights that concerns here are not just about Notepad becoming 'Bloatpad', but also that these new features may not just bog down the app - making it less responsive over time with the incremental weight of said additions - they can also put the user at risk.

PC Gamer reports that the new tables feature brought in for Notepad recently - allowing for formatting basic tables in your text docs - has a remote code execution flaw.

Microsoft rates the vulnerability as 'high' in terms of its severity, explaining that: "Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network." The upshot is that if a Notepad user opens a Markdown file downloaded from the malicious actor, and clicks the dodgy link said attacker has placed inside, then the PC will be compromised. The attacker will get the same level of system privileges as the victim, meaning if this is the admin account, they'll obtain full admin access.

Obviously that's very bad news, but still - the attack does rely on downloading a file from an unknown site, and then actually clicking the link (with the host PC being online, of course). And we all know to be very careful with any remotely suspect looking links at this point...

Still, this is clearly something to be aware of if you use Notepad, but the good news is that the fix has been implemented. You'll need to update your copy of the app to the latest version via the Microsoft Store to get the cure, so if you've got a spare moment, it might be worth doing that now.