Discussion
Loading...

Post

Log in
  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
pheonix
pheonix
@pheonix@hachyderm.io  ·  activity timestamp 11 hours ago

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things lmao.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system. Is nothing safe anymore? 😭

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

#noai #microslop #microsoft #windows #programming #writing #windows11 #enshittification #cybersecurity #infosec #technology

screenshot from the CVE page
screenshot from the CVE page
screenshot from the CVE page

Security Update Guide - Microsoft Security Response Center

  • Copy link
  • Flag this post
  • Block
Fabio Manganiello
Fabio Manganiello
@fabio@manganiello.eu replied  ·  activity timestamp 5 hours ago

@pheonix the thing is that there are many, many safe existing libraries to properly render and parse #Markdown without exposing yourself to RCE.

But my guess is that some project manager at #Microsoft simply went like “nah, I don’t want to wrestle with those licensing issues - just implement a Markdown parser/renderer from scratch, specifically tailored for all the legacy code we have in Notepad, with this over-stretched team of 3 contractors, and get it done by the end of the quarter”.

Fabio's Space

Fabio's Space

  • Copy link
  • Flag this comment
  • Block
JKB
JKB
@jkb@gotosocial.jkbockstael.be replied  ·  activity timestamp 9 hours ago

@pheonix According to the report you have to click a link in the file, just loading it won't compromise the system.

  • Copy link
  • Flag this comment
  • Block
⠠⠵ avuko
⠠⠵ avuko
@avuko@infosec.exchange replied  ·  activity timestamp 7 hours ago

@jkb @pheonix That seems to be the case, although the weakness is in Microsoft Notepad incorrectly handling “an unverified protocol”, not in something the user then has to do or interact with. Besides clicking a link.

This reads to me like an URI protocol handling issue.

And that functionality is not something they’d have to reinvent or vibe code.

You know, with their proprietary plain text editor running on their proprietary OS, and next to their proprietary file explorer, their proprietary internet browser, their proprietary email client and proprietary network agents.

All their proprietary software handling URI protocols… RIGHT THERE.

  • Copy link
  • Flag this comment
  • Block
JKB
JKB
@jkb@gotosocial.jkbockstael.be replied  ·  activity timestamp 5 hours ago

@avuko @pheonix Yes, indeed. And yes indeed this is something that should have never happened, the whole situation is shameful.

I was just pointing out that this vulnerability requires additional user input (albeit a very likely user input that normally shouldn't raise any concern), it's not one of those nightmare situations in which the mere opening of a file triggers an exploit.

  • Copy link
  • Flag this comment
  • Block
Gabriele Svelto
Gabriele Svelto
@gabrielesvelto@mas.to replied  ·  activity timestamp 9 hours ago

@pheonix *vibe-coding intensifies*

  • Copy link
  • Flag this comment
  • Block

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances
Bonfire social · 1.0.2-alpha.23 no JS en
Automatic federation enabled
Log in
  • Explore
  • About
  • Members
  • Code of Conduct