They finally did it.
-
They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.
This CVE is an 8.8 severity RCE in Notepad of all things lmao.
Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.
We have reached a point where the simple act of opening a .md file in a native utility can compromise your system. Is nothing safe anymore?
#noai #microslop #microsoft #windows #programming #writing #windows11 #enshittification #cybersecurity #infosec #technology
@pheonix another reason to switch on linux, only thing that can hold someone from switching is adobe software
-
@jkb @pheonix That seems to be the case, although the weakness is in Microsoft Notepad incorrectly handling “an unverified protocol”, not in something the user then has to do or interact with. Besides clicking a link.
This reads to me like an URI protocol handling issue.
And that functionality is not something they’d have to reinvent or vibe code.
You know, with their proprietary plain text editor running on their proprietary OS, and next to their proprietary file explorer, their proprietary internet browser, their proprietary email client and proprietary network agents.
All their proprietary software handling URI protocols… RIGHT THERE.
@avuko @pheonix Yes, indeed. And yes indeed this is something that should have never happened, the whole situation is shameful.
I was just pointing out that this vulnerability requires additional user input (albeit a very likely user input that normally shouldn't raise any concern), it's not one of those nightmare situations in which the mere opening of a file triggers an exploit.
