I don’t think it does. The MSRC page linking to the notepad update release notes/download goto the windows store version of notepad, which lists a requirement of Windows 11 version 22000.0 or higher.

I haven’t gone more in depth than that though.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

User interaction required was listed on the MSRC source, but that’s also where “RCE” came from too.

On GOS, Settings > Security > Exploit protection

Vendor tech does maintenance and fails to check critical component of system blames customer

Good tech.