Microsoft managed to introduce a critical vulnerability in Notepad, so this does not surprise me