Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

451–460 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#451

Post by jiggawatts »

For Linux folks: Notepad is the Windows equivalent of a console editor such as Pico or Vi.

Its job is to be robust, simple, and always available.

It's supposed to show you the symbols in markdown, not render them.

It is useful for opening potentially dangerous content in a 100% safe way, because "txt" should always be safe to inspect!

It is regularly used to open gigabyte-sized log files and the like, which it has to handle on machines with less free memory than that! Markdown rendering and similar features are fundamentally incompatible with this requirement because they require serialised parsing of the entire file instead of opening just tens of kilobytes at a time using memory mapping or whatever.

Notepad is also used to open files without taking a lock, allowing users to read files that are actively being written to. Again, incompatible with practically all parsing strategies.

The "new Notepad" is some dumbass executives pet project that overlaps with Visual Studio Code and is a shitty alternative to WordPad, which another dumbass executive axed for no good reason.

Re: Windows Notepad App Remote Code Execution Vulnerability

#452

Post by d3Xt3r »

b3lvedere wrote: post #211
mdavid626 wrote: post #31

Earlier quoted context omitted.

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

Kind of a weird feeling that in order to get the better Windows 11 experience one requires programs from four operating system versions earlier. Windows 11 also takes a huge amount of time to get working as i intend. I have to remove a lot of 'features' and heavily optimize some processes. It's stable and it works, but i'm getting more and more annoyed by it that upcoming updates sometimes destroy all my effort. Kind…

> Kinda wish i could run everything my family wants on Debian. I know i could do that right now, but the wife and kids will never get used to that if they have to use Microsoft products in their working and school life.

You won't know until you try. My mum used all versions of Windows from 3.1 till Windows 7. She hated Windows 8, and that's when I decided to switch her to Linux (with XFCE) - and she felt the UI was a lot more familiar to her than Windows 8. I recently showed her a few screenshots of Windows 11, and she finds her current desktop (now on KDE) a lot more familiar than Windows 11. Same with Office, she prefers the older style toolbar of LibreOffice than the ribbon UI of modern versions Office.

So maybe install it on a spare device as a trial and see how they like it?

Re: Windows Notepad App Remote Code Execution Vulnerability

#453

Post by abustamam »

graemep wrote: post #260
mjmas wrote: post #134

It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

Is this a big deal? is it also not a problem with anything that renders clickable links? Browsers, email clients, whatever. Is this not a problem with anything that offers a preview of markdown (or HTML, or anything with embedded links)?

It could be. But why is notepad doing anything other than rendering text? I don't expect it to make links clickable, or render markdown.

Re: Windows Notepad App Remote Code Execution Vulnerability

#454

Post by d3Xt3r »

mdavid626 wrote: post #375
b3lvedere wrote: post #211

Earlier quoted context omitted.

Kind of a weird feeling that in order to get the better Windows 11 experience one requires programs from four operating system versions earlier. Windows 11 also takes a huge amount of time to get working as i intend. I have to remove a lot of 'features' and heavily optimize some processes. It's stable and it works, but i'm getting more and more annoyed by it that upcoming updates sometimes destroy all my effort. Kind…

I’d wish to use Linux. But some things just don’t run there (properly). Like Assetto Corsa EVO or SimHub.

When was the last time you tried it? Assetto Corsa EVO has a Gold rating on ProtonDB[1] and apparently SimHub also works fine, according to the SimHub forums[2].

[1] https://www.protondb.com/app/3058630 [2] https://www.simhubdash.com/community-2/simhub-support/guide-...

Re: Windows Notepad App Remote Code Execution Vulnerability

#455

Post by gunalx »

DuckConference wrote: post #392
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

It splits revenue out to 3 categories, "Productivity and Business Processes", "Intelligent Cloud", and "More Personal Computing", with windows as one of several things in the 3rd group. How did you figure it out as a 5th place revenue source?

You can also kinda read the 3 categories as office, azure, windows. But that is a gross oversimplification.

Re: Windows Notepad App Remote Code Execution Vulnerability

#456

Post by jameshart »

voidUpdate wrote: post #26

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

Notepad always used to be essentially the standard MFC multiline text editor control in a window.

Wordpad was the same but a rich text editor control.

There’s very little need for it to have ever become more.

Re: Windows Notepad App Remote Code Execution Vulnerability

#457

Post by 0cf8612b2e1e »

hbn wrote: post #442
DavidPeiffer wrote: post #385

Earlier quoted context omitted.

I was really hoping this CVE would have been caused by the Copilot integration into Notepad. Calculator hasn't been infiltrated by Copilot yet, but I'm sure the day is coming.

Calculator asks you to rate it in the app store... You're the preinstalled calculator!! You don't have to compete with other apps!!

The desperation for feedback is grating. You have a monopoly position, you know I cannot switch from this, why waste my time with this dialogue? Not like you take user opinions seriously anyway.

Re: Windows Notepad App Remote Code Execution Vulnerability

#458

Post by d3Xt3r »

tracker1 wrote: post #379
tomNth wrote: post #209

Earlier quoted context omitted.

I like paint shop pro, I use 4.12.

I need to just break down and find an old version of that... from before the Jasc sellout. IIRC, it ran via Wine without issue too. I try to use Pinta/Paint.Net, but it's not quite as good as I remember psp being. I don't even hate the newer MS Paint... thought I'm only on windows for my work environment and even then. Aside: I've been using my personal computer more, so I can work on a limited surface with docker an…

If you don't mind using a browser, Photopea is pretty awesome: https://www.photopea.com/

Re: Windows Notepad App Remote Code Execution Vulnerability

#460

Post by smegger001 »

bigbuppo wrote: post #391
Culonavirus wrote: post #384

Earlier quoted context omitted.

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

This is why I have been saying that Microsoft is about to go the way of Sears when the AI bubble pops.

I don't know about that they have multiple successful businesses with or without AI and they stand to have all of OpenAI's IP when they implode (their license gives them free access to fork all of OpenAI's AI models with the sole exception of some hypothetical future artificial general intelligence) my guess is they take a hit to the stock price but so will everyone else and they will go on a shopping spree of buying up any IP or infrastructure left after the bubble pops.
Post reply on HN