We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…
> viewing data is a fundamental failure of the principle of least privilege. I read the cwe not cve, was wrong. It's still early in the morning...
You are mistaken:
> The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.