You can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows.
This isn't an AI slop problem.
Windows Notepad App Remote Code Execution Vulnerability
61–70 of 538 posts
Re: Windows Notepad App Remote Code Execution Vulnerability
#62I'd now like to see a RCE in MS Paint or Calculator, if the exploit finder is reading this.
Re: Windows Notepad App Remote Code Execution Vulnerability
#63Earlier quoted context omitted.
Strictly, no. But it was a vulnerability in the design of Notepad++, key elements here being the featureset that requires frequent updates and the lack of integrity checks during the upgrade process. This has prompted me to move on from Notepad++ - it's sad, because I've used it for many years, but this is too much.
> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.
I'm not sure who I trust less to handle package integrity, the 3rd party hosting provider that Notepad++ used, or Microsoft.
Re: Windows Notepad App Remote Code Execution Vulnerability
#64Seems whatever they do they step in shit. They should stop doing stuff. They spent the last few years entirely compromising their products rather than improving them.
Exactly my predicament. My laptop reached EOL but I'm struggling to purchase a new one.
They're all bundled with AI features (I absolutely don't need) and never in my life will I buy a mac for coding. My current laptop is HODL'ing and idk if this enshittification will end soon.
Re: Windows Notepad App Remote Code Execution Vulnerability
#65use SublimeText, it is perhaps faster now than the stock Notepad
Re: Windows Notepad App Remote Code Execution Vulnerability
#66You can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows. This isn't an AI slop problem.
Tools are almost never the problem.
The application of tools is.
Re: Windows Notepad App Remote Code Execution Vulnerability
#67We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…
I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile.
I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard.
It’s inspectable if you want to check the crate: https://github.com/BrowserBox/FIPSPad
Re: Windows Notepad App Remote Code Execution Vulnerability
#68I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too
I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.
For those of you on macOS who still want to benefit from arguably the best drawing application ever conceived, https://jspaint.app/ is THE way. Use it all the time when editing screenshots.
Bonus point: that Windows 95 style "error" beep when pasting too large image. Always sends the shiver down the spine and confuses the coworkers around (we're an all-Mac shop).
Re: Windows Notepad App Remote Code Execution Vulnerability
#69I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too
Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.
The reason being it is a plain text edit component, with a window around it, hence the limitation.
Re: Windows Notepad App Remote Code Execution Vulnerability
#70Earlier quoted context omitted.
> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.
I'm not sure who I trust less to handle package integrity, the 3rd party hosting provider that Notepad++ used, or Microsoft.
A little tongue-in-cheek, but it's also an issue with windows, that it's owned by an untrustworthy company.