Windows Notepad contains a command injection weakness (CVE-2026-20841) where special elements in a command are not properly neutralized. This flaw, identified as CWE‑77, permits an attacker who may not be authenticated to run arbitrary commands on the local machine. The impact is the potential for any code to be executed with the permissions of the current user, compromising confidentiality, integrity, or availability of the affected system.

The vulnerability affects Microsoft Windows Notepad. No specific version ranges are supplied, so any installation of Notepad that has not yet been updated through Microsoft’s security channels could be susceptible.

The CVSS score of 7.8 indicates that the flaw is high severity, while an EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The issue is not listed in the CISA KEV catalogue. Attacks would most likely occur in a local context, such as from a malicious document, shortcut, or other user‑initiated action that triggers the vulnerable code path.