Critical Bing SVG Flaws Let Attackers Run Commands as SYSTEM on Microsoft Servers

Two critical command-injection vulnerabilities in Bing Images allowed specially crafted SVG files to execute arbitrary code as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. Tracked as CVE-2026-32194 and CVE-2026-32191, both flaws were rated 9.8 on the CVSS scale and were discovered by XBOW, the autonomous offensive security startup, which reported them privately to Microsoft. The bugs sat in Bing's image-processing tier, not on a single misconfigured host, as XBOW reproduced the same behavior across workers in different network ranges.

The root cause was ImageMagick's delegate execution. When Bing's reverse image search fetches an image URL, it hands the file to a conversion suite that, for formats it does not handle natively, shells out to external programs. Because delegates were still enabled, an SVG referencing a path beginning with a pipe character was interpreted as a command rather than a filename. A one-pixel SVG with a piped reference ran arbitrary code on the worker and curled the output back to an XBOW-controlled collector. Two attack paths reached the same pipeline. CVE-2026-32194, filed as CWE-77, targets the public "Search by Image" upload, where a base64-encoded SVG is submitted as the imageBin field to /images/kblob. CVE-2026-32191, filed as CWE-78, exploits the crawler route: host the SVG anywhere, pass its URL to Bing via the imgurl parameter, and bingbot/2.0 fetches and parses it. Neither path requires authentication, cookies, or a click.

Microsoft patched both issues server-side before the advisories published on March 19, and stated there is "no customer action to resolve." XBOW held back exploit mechanics at Microsoft's request and only disclosed the technical details on July 23, 2026, after remediation had landed. Neither CVE record listed known exploitation or prior public disclosure at the time of publication. The lesson for defenders running their own image pipelines is straightforward: if attacker-controlled content can reach an ImageMagick or ImageMagick-compatible processor with delegates enabled, the same shape of bug applies. Strip the delegates, restrict accepted formats, and segment the worker off the wider network, and the payload does nothing. Operators can audit their own exposure with a port scanner to confirm processing workers are not reachable from the public internet, and run an SSL/TLS checker to verify the services still in scope are not presenting expired or weak certificates. A broader privacy checkup is a useful next step for teams reviewing the trust boundaries between user uploads, server-side fetchers, and downstream parsers.