Google Project Zero researcher Tavis Ormandy revealed on Tuesday that he identified a code execution vulnerability in Microsoft’s Notepad text editor.
Ormandy says he has reported his findings to Microsoft and the company has been given 90 days – per Project Zero’s vulnerability disclosure policy – to release a patch. Details of the security hole will be made public after 90 days or possibly sooner if Microsoft rolls out a fix.
The researcher has only revealed so far that the vulnerability is a memory corruption and he posted a screenshot showing how he managed to “pop a shell in Notepad.” The screenshot apparently shows that the vulnerability has been exploited to spawn a Windows Command Prompt.
Several individuals have speculated on how the flaw may be triggered, but Ormandy has not released any information on the topic. He did, however, clarify that he has developed a “real exploit” for it.
Chaouki Bekrar, founder of exploit acquisition firm Zerodium, suggested on Twitter that this is not the only memory corruption vulnerability that can be used to “pwn” Notepad.
Ormandy found many vulnerabilities in popular software in the past years, including Microsoft’s Malware Protection Engine, uTorrent, Grammarly, Keeper, Ghostscript, LastPass, Kaspersky Antivirus, and Cisco WebEx.
Related: Windows Defender Ported to Linux in Fuzzing Tool Demo
Related: Notepad++ Site Hacked in Response to “Je suis Charlie” Edition

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
- Cybercriminals, APT Exploited Telerik Vulnerability in Attacks on US Government Agency
- US Charges Two Men Over Use of Hacked Law Enforcement Database for Doxing
Latest News
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- New York Man Arrested for Running BreachForums Cybercrime Website
- Huawei Has Replaced Thousands of US-Banned Parts With Chinese Versions: Founder
- Latitude Financial Services Data Breach Impacts 300,000 Customers
