An SVG image ran commands with SYSTEM privileges on Bing Images servers

XBOW, a company specializing in autonomous offensive testing, discovered a pair of critical vulnerabilities in Bing's image search engine. It was enough to feed a specially assembled SVG file into processing for arbitrary commands to run on Microsoft's worker nodes — on Linux machines with the root identifier (uid=0), and on Windows Server 2022 with NT AUTHORITY\SYSTEM privileges. The same result reproduced across different hosts and different network ranges, meaning the problem sat in the image-processing layer itself rather than on a single faulty machine.

Microsoft assigned the findings two identifiers — CVE-2026-32194 and CVE-2026-32191 — and rated both at 9.8 on the CVSS scale. Users have nothing to fix: the patches were applied server-side back before the advisories were published in March. XBOW disclosed the technical mechanics only on July 23, holding them back at Microsoft's request until the problem was resolved.

How an image became a shell

The essence of the bug is that the application assumed it was working with an image, while the underlying handler read part of that “image” as a command. Bing's reverse image search itself fetches the image by URL — at first glance this is just a blind SSRF that returns nothing to the client. The tell was an error: some nodes returned a 500 to the browser but still downloaded and parsed the received file.

An SVG is not pixels but XML: it can reference other images, and the renderer dutifully follows them. Converters like ImageMagick pass unsupported formats to external delegate programs invoked through a shell. On the path the researchers reached, this layer remained enabled, so a reference beginning with a pipe character went to the shell rather than being read as a filename. The payload was a one-pixel SVG whose reference ran a command and sent the output back via curl.

Hence two routes into the very same converter: CVE-2026-32194 — a public upload via “Search by image” (SVG in the imageBin field), and CVE-2026-32191 — the crawler route, where bingbot itself fetches the file from the address passed via imgurl. Neither requires authentication, a cookie or a click.

An old ailment

This is the same class of bug as the decade-old ImageTragick (CVE-2016-3714), and it resurfaces because no one considers the converter part of the attack surface. XBOW CISO Nico Waisman put it this way: applications treat image handlers like plumbing, while attackers treat them like parsers.

ImageMagick's own documentation warns outright: the default policy is open and intended for an isolated environment, not a public site. For untrusted images it recommends disabling delegates entirely in policy.xml, trimming the list of accepted formats (SVG, MVG and EPS carry references and interpreters within them), running conversion in a sandbox with reduced privileges, and blocking outbound traffic from the worker node — the very channel that turned a blind vulnerability into a proven one.

Source: The Hacker News