Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
Bing Image Search had two critical vulnerabilities allowing attackers to execute commands as SYSTEM on Microsoft's servers by submitting crafted SVGs. The issue stemmed from a helper component that treated SVG files as commands, bypassing security measures. While Microsoft fixed the issue in March and reported no exploitation, an autonomous security startup, XBOW, discovered and published the exploit mechanics in July. Mitigation involves disabling delegates, restricting accepted formats, and isolating worker processes to prevent access to external networks.
Bing Image Search was vulnerable to two critical security flaws, CVE-2026-32194 and CVE-2026-32191, allowing attackers to execute commands as SYSTEM on Microsoft's production servers. The root cause was a helper component that incorrectly interpreted SVG files as commands, bypassing standard security protocols. Autonomous security startup XBOW discovered and published the exploit mechanics in July, after Microsoft had already addressed the issue in March, reporting no public disclosure or exploitation at that time.
XBOW’s testing demonstrated that a crafted SVG could be submitted to Bing’s image search, running commands as NT AUTHORITY SYSTEM on Microsoft’s servers, and as root on the Linux machines within the same fleet. The vulnerability was triggered by a helper component that treated SVG files as commands, rather than as image data.
Specifically, the vulnerability was found in the ‘Search by Image’ upload (CVE-2026-32194) and the crawler route (CVE-2026-32191). The ‘Search by Image’ upload involved submitting a base64-encoded SVG, while the crawler route involved hosting the SVG anywhere and providing its URL through the imgurlparameter. Neither required authentication, cookies, or session state.
Interestingly, the exploit worked even if the frontend returned an error, as the worker continued to execute the command. On Linux workers, the process ran with uid=0 and gid=0, and on Windows, systeminfo showed SeImpersonatePrivilege and SeDebugPrivilege enabled, indicating elevated privileges. The firm confirmed that only benign read-only commands were executed and no customer data was touched.
XBOW’s research highlighted that ImageMagick, a common image processing library, has a default policy that is open and intended for sandboxed or firewalled use, not a public website. To mitigate the vulnerability, Microsoft recommends disabling delegates, restricting accepted formats (such as SVG, MVG, and EPS), running conversion sandboxed with reduced privileges, blocking outbound network access from the worker, and allowinglist the destinations a server-side fetch may reach. The firm also noted that ImageTragick, a similar delegate command injection vulnerability tracked as CVE-2016-3714, has resurfaced due to a lack of consideration for the converter as part of the attack surface. Ultimately, the exploit was successful because the parser behind the SVG was incorrectly interpreting it as a command, not as image data.