# Bing Images Vulnerability Allowed SYSTEM Command Execution on Microsoft Servers Crafted SVG files could execute commands with highest privileges on production servers. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-24 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/75515137-6d03-44aa-9080-7ecd3f0141a0 ## Critical Vulnerability Discovery Security startup XBOW found a critical flaw in Bing's image search that allowed command execution as NT AUTHORITY\SYSTEM on Windows servers and as root on Linux machines. Microsoft promptly patched these vulnerabilities, rating them 9.8 on the CVSS scale. ## Technical Details of the Exploit The system used ImageMagick's delegation feature when processing SVG files. Malicious SVGs with pipe-character references were interpreted as shell commands, enabling privileged command execution and data exfiltration from the servers. ## Two Distinct Attack Vectors The vulnerability could be exploited two ways: through user-uploaded base64-encoded SVGs and via external URLs crawled by Bing's bot. Both methods required no authentication. Microsoft assigned CVE-2026-32194 and CVE-2026-32191 to these vectors. ## Microsoft's Rapid Response After private disclosure by XBOW, Microsoft implemented server-side fixes requiring no customer action. While patched in March, details were only made public in July. Microsoft confirmed no evidence of exploitation before the fixes. ## Historical Context of Similar Flaws A similar vulnerability (ImageTragick) affected ImageMagick in 2016. Experts note image processing systems are often overlooked as attack surfaces. XBOW CISO Nico Waisman emphasized that attackers view these systems as parsers rather than just plumbing. ## Key Security Takeaways Security recommendations include disabling all delegates in policy.xml, limiting accepted file formats, and restricting worker network access. ImageMagick's default policies are noted as unsuitable for public-facing systems without proper sandboxing. ## Sources covering this story - https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._