Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

431–440 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#431

Post by estimator7292 »

Culonavirus wrote: post #384
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

Holding one's unsubstantiated personal beliefs above all evidence and rational argument is, in fact, delusion.

The evidence in TFA is that Microsoft is much more than Windows. So much more in fact that one can make a very reasonable argument that it's no longer a top priority for them.

The delusion is shutting your eyes, covering your ears, and screaming about how literally everyone except you is wrong.

Re: Windows Notepad App Remote Code Execution Vulnerability

#432

Post by [deleted] »

spprashant wrote: post #295
latexr wrote: post #230

Earlier quoted context omitted.

Something felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?

Looks like they logged in the first time in years to make a post https://news.ycombinator.com/item?id=46975123 And decided to jump in on some threads just as well.

[deleted]

Re: Windows Notepad App Remote Code Execution Vulnerability

#433

Post by colinsane »

ankurdhama wrote: post #92
hdgvhicv wrote: post #47

So notepad now renders links, then when clicks execute the code on those links (not just loading a website in a browser for example)?

My assumption here is that if the link is web link it will open that link in web browser but Windows (and other OSes) have custom URL handlers that open whatever app is registered for that URL and that app may have issues that causes it to download and run arbitrary code.

Windows and other OSes have application launchers that open whatever app you want, and those apps may have issues that cause it to download and run arbitrary code. if that's the logic here, then every application launcher is vulnerable to similar RCE.

if there's really nothing more to this 8.8 RCE CVE than that, this will finally be the thing that's makes me blackhole cve.org.

Re: Windows Notepad App Remote Code Execution Vulnerability

#434

Post by dgxyz »

omoikane wrote: post #426
dgxyz wrote: post #46

Earlier quoted context omitted.

Might as well just use Windows 7 if the security surface is this bad on later windows.

Windows 7 market share was actually growing for a while according to: https://gs.statcounter.com/windows-version-market-share/desk... Not sure what caused the inflection point in December 2025.

wonder if it was dumping off windows 10 machines or lay offs that did it.

Re: Windows Notepad App Remote Code Execution Vulnerability

#435

Post by joquarky »

wang_li wrote: post #411
titzer wrote: post #313

Earlier quoted context omitted.

As I posted in a sibling, I thought the whole point of markdown was that it was simplified to the point that rendering it was easy to do from scratch. But we fumbled that because we (collectively) have no idea what we are doing.

>But we fumbled that because we (collectively) have no idea what we are doing. Because, almost entirely, the software development industry has disclaimed all responsibility. It's super common for people to try to do shit they have no experience or skill at, push their effort to be adopted by others, then when it crashes and burns they have no accountability. If software "engineers" adopted the rigors and accountabili…

Even traditional engineering is now being coerced by "move fast and break things" management.

It feels like a plague of ignorance and enshittification has silently taken over everything.

Re: Windows Notepad App Remote Code Execution Vulnerability

#436

Post by danudey »

DavidPeiffer wrote: post #385
BLKNSLVR wrote: post #182

Earlier quoted context omitted.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

I was really hoping this CVE would have been caused by the Copilot integration into Notepad. Calculator hasn't been infiltrated by Copilot yet, but I'm sure the day is coming.

Hey Calculator, how many R's are there in strawberry?

Re: Windows Notepad App Remote Code Execution Vulnerability

#437

Post by [deleted] »

Someone1234 wrote: post #236
Hackbraten wrote: post #191

Earlier quoted context omitted.

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline. If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.

[deleted]

Re: Windows Notepad App Remote Code Execution Vulnerability

#438

Post by titzer »

jerf wrote: post #399
titzer wrote: post #310

Earlier quoted context omitted.

I might be dumb, but I thought the whole point of markdown was to get rid of all the bells and whistles of styling, having a really simplified and dumb format that only outlines structure. The follow-on being that many tools could parse, transform and render said markdown files in a way that makes sense for them. That way there's lots of tools that don't share code, but a shared definition of the format . I.e. markdo…

Goals aren't results. It was a goal for Markdown to be simple and universal. It is not a result. You may be struggling a bit because you are reading some sort of moralization into the statement, some sort of emotional judgment, but there isn't any. It is clear that there does not exist a function that takes a span of "Markdown text" in and emits an abstract syntax tree that everyone agrees upon [1]. That's a fairly m…

The answer, of course, is to design a new, universal markdown format :)

But seriously though, all those weird markdown formats could easily just have their own custom parsers than then translate into the common format--supposing the common format is the union of all their features.

Re: Windows Notepad App Remote Code Execution Vulnerability

#440

Post by BuildTheRobots »

setopt wrote: post #84
SomeUserName432 wrote: post #75

Earlier quoted context omitted.

I find notepad useful for sanitising clipboard content. No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else. Ala Cmd+Shift+V on Mac

I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.

I've been using Win+R to paste it in the windows run box.

Amazingly still works on Win 11 and still seems to keep it local (bypassing the windows search), so I'm pleased to report consistent results for 30 ish years.

Of course, now I've mentioned it out loud, it'll be the next thing to go...

I don't know if it's just me being old and grumpy, but everything windows 8 and later (server 2003) seems like half-baked, unfinished enshittification. Trying to do something even vaguely "advanced" to a network adapter puts me back in windows 95 land along with the run box. The "manage" pane with device & disk manager and logs is from a totally bygone era yet it seems to still be the only way of getting that information. The worst bit is, I'm not complaining. All the bits that look and feel like they've been forgotten since Windows 2000 are the easiest, least infuriating bits of the system I interact with.

Post reply on HN