Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

Two critical vulnerabilities in Microsoft's Bing Images service allowed attackers to execute arbitrary commands with full system privileges using specially crafted SVG files. The flaws, tracked as CVE-2026-32194 and CVE-2026-32191, were discovered by XBOW and rated 9.8 on the CVSS scale. Attackers could exploit these issues without authentication by either uploading a malicious SVG or providing a URL pointing to one. Microsoft addressed both issues internally before publicly disclosing them in March 2026, stating no customer action is required. The vulnerabilities stemmed from how Bing’s image-processing pipeline handled SVG references, enabling command injection through ImageMagick delegates. Developers are advised to follow best practices such as disabling delegates, restricting accepted image formats, and isolating processing workers.