Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

461–470 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#461

Post by derefr »

Culonavirus wrote: post #384
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

But it doesn't matter that Azure is garbage, because the people they market it to are big enterprise CTOs, not the actual engineers who'll have to use it. Azure has quite a few of the S&P500 using it.

Re: Windows Notepad App Remote Code Execution Vulnerability

#462

Post by d3Xt3r »

Ntrails wrote: post #334
MarleTangible wrote: post #214

Earlier quoted context omitted.

They also wanted to use the popularity of Notepad, so they replaced it with an AI bloatware version instead of creating a new app with extra features.

How long were they threatening to kill snipping tool despite it being a perfectly serviceable piece of kit so we could switch to some shitty alternative?

They did ultimately kill it though - and then they re-created it as a bloated UWP version that is an insane 449 MEGABYTES in size! The old win32 Snipping Tool used to be only a few kilobytes...

Re: Windows Notepad App Remote Code Execution Vulnerability

#463

Post by asadm »

gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Windows is their trojan-horse.

Re: Windows Notepad App Remote Code Execution Vulnerability

#464

Post by derefr »

samspot wrote: post #408
BLKNSLVR wrote: post #182

Earlier quoted context omitted.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

It's hard for me to imagine anyone balking at this feature. My core note taking workflow frequently involves: 1. Note about blah 2. Paste link to blah 3. Open that link later when reviewing my notes. Blah is sometimes a web link, sometimes a link to a doc on my system, and sometimes a link to an item in my todo tracker. The better analogy is this is like a pencil having an eraser built in. I use Drafts instead of Not…

Notepad stuck around in Windows for so long, despite Wordpad also being built-in, because Notepad was supposed to be for e.g. editing C:\AUTOEXEC.BAT or C:\Windows\System32\hosts.txt in Safe Mode. It was basically supposed to be the /bin/sh to Wordpad's /bin/bash — the thing that'll save you in maintenance mode when the system is so hosed that nothing more complex will launch.

If your computer was working, there was never really supposed to be a reason to invoke Notepad. Programmers were expected to install IDEs or third-party text-editor software. Microsoft's own READMEs have always been .rtfs ever since Windows 95. And so on. For a little while, you might use it to view system log files? But the Windows NT lineage gave Windows an Event subsystem with its own MMC-based console, so even that didn't require Notepad any more.

It's therefore bizarre that Microsoft have decided to "enhance" Notepad into this pseudo-rich-text thing, while also sunsetting Wordpad; when it seems like what they really wanted was to "enhance" Wordpad to also do what Notepad does, while sunsetting Notepad. (Even with full back-compat, they could have done this by making Notepad.exe a stub that launched Wordpad.exe with flags.)

Re: Windows Notepad App Remote Code Execution Vulnerability

#465

Post by FridgeSeal »

vachina wrote: post #344
ThrowawayB7 wrote: post #297

Earlier quoted context omitted.

If I had to guess, the mandate to cram AI in everywhere came down from Nadella and the executive level with each level of management having KPIs for AI in their product all the way down. Much like the "everything has to be .NET even though nobody has any idea what .NET means" when it was first introduced and every MS product suddenly sprouted .NET at the end of their names. When executive management gives stupid non-…

AI is useful but these management type typically don’t know how to make it useful.

That’s why they spend all their time on LinkedIn creating “7 levels of ai readiness” instead of…actually doing anything productive and useful.

Re: Windows Notepad App Remote Code Execution Vulnerability

#466

Post by FridgeSeal »

titzer wrote: post #306
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

It'd be more hilarious if it weren't so sad. In just 10 years a disturbingly large number of huge development teams decided that making a GUI application using the old ways [1] was too hard and decided to ship an entire web engine (electron) to render 10 buttons. [1] (native GUI widgets? agggh)

Large swathes of this industry have an obsession with investing 10x more resources into the wrong thing, than simply fixing the underlying issue.

Re: Windows Notepad App Remote Code Execution Vulnerability

#467

Post by d3Xt3r »

wisplike wrote: post #366

How are these discovered? Is it just a well informed guess or do people decompile these programs?

Can't speak for others, but this one is a fairly obvious vulnerability for someone who's in this field - similar bugs have existed back in the day in web browsers, and even somewhat recently on other platforms like Android (messages app) etc. Basically anything that displays clickable links, or renders web content etc - there's a high probably of there being a vulnerability, you just need to test a few well-known scenarios (and there are automated test suits for these things too).

The moment Microsoft started adding crap to Notepad, we knew that it was only a matter of time before such a vulnerability cropped up.

Re: Windows Notepad App Remote Code Execution Vulnerability

#468

Post by d3Xt3r »

w4yai wrote: post #117
ddtaylor wrote: post #99

Earlier quoted context omitted.

Do you have a moment to talk about Linux?

Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?

I don't know if it's an option for you, but my workplace provides me with a Citrix VDI that I remote into from my BYOD Linux laptop. So I use the VDI for all the windows-only stuff, and everything else is web-based/has a PWA (like Teams, Outlook, Office etc), which works fine in Linux.

Re: Windows Notepad App Remote Code Execution Vulnerability

#469

Post by d3Xt3r »

avaer wrote: post #86
egorfine wrote: post #66

Earlier quoted context omitted.

Tools are almost never the problem. The application of tools is.

I 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out. There must be something much worse than slop going on to get to this point.

What most people don't realise is that this enshittification has been ongoing since a long time, about the time of Windows 8 and the introduction of "Metro"/UWP apps. The Control Panel was the first victim - replaced by the shitty Settings app which we saw in Win10. But along the way, MS have been slowly replacing the good ol' small and fast win32 apps with highly bloated UWP versions. It's not just Notepad now, every core Windows app is a UWP app.

People don't realise how much bloat this is. The new Snipping tool for instance is 449 MEGABYTES, whereas it used to be only a few KB in size. Same with Paint, Calculator etc - all bloated UWP apps.

UWP was a mistake, they should've stuck to win32, at least for core apps.

Re: Windows Notepad App Remote Code Execution Vulnerability

#470

Post by AnonymousPlanet »

iugtmkbdfil834 wrote: post #181
AnonymousPlanet wrote: post #54

Earlier quoted context omitted.

I'm not sure if we should use "gold standard" together with the little piece of garbage that notepad.exe was for most of its existence. It has been the bane for anyone who had to do work on locked down Windows servers and had to, e.g., edit files with modern encodings. They fixed some of it in the meantime, but the bitter taste remains.

You do have a point, because it shows an unfortunate inflation in words. That said, on a fresh windows install, notepad was usually an island of stability in a sea of sorrow. The day I saw AI introduced to it, I knew the end is nigh.

When you have to edit text files on a locked down Windows server that are UTF-8 like everything else in the world and your only tool is notepad.exe, it's the island of pain.
Post reply on HN