Bing Images Vulnerability Allowed SYSTEM Command Execution on Microsoft Servers
Crafted SVG files could execute commands with highest privileges on production servers.
1Critical Vulnerability Discovery
Security startup XBOW found a critical flaw in Bing's image search that allowed command execution as NT AUTHORITY\SYSTEM on Windows servers and as root on Linux machines. Microsoft promptly patched these vulnerabilities, rating them 9.8 on the CVSS scale.
2Technical Details of the Exploit
The system used ImageMagick's delegation feature when processing SVG files. Malicious SVGs with pipe-character references were interpreted as shell commands, enabling privileged command execution and data exfiltration from the servers.
3Two Distinct Attack Vectors
The vulnerability could be exploited two ways: through user-uploaded base64-encoded SVGs and via external URLs crawled by Bing's bot. Both methods required no authentication. Microsoft assigned CVE-2026-32194 and CVE-2026-32191 to these vectors.
4Microsoft's Rapid Response
After private disclosure by XBOW, Microsoft implemented server-side fixes requiring no customer action. While patched in March, details were only made public in July. Microsoft confirmed no evidence of exploitation before the fixes.
5Historical Context of Similar Flaws
A similar vulnerability (ImageTragick) affected ImageMagick in 2016. Experts note image processing systems are often overlooked as attack surfaces. XBOW CISO Nico Waisman emphasized that attackers view these systems as parsers rather than just plumbing.
6Key Security Takeaways
Security recommendations include disabling all delegates in policy.xml, limiting accepted file formats, and restricting worker network access. ImageMagick's default policies are noted as unsuitable for public-facing systems without proper sandboxing.