Microsoft Bing Images Vulnerabilities Allow Remote Code Execution via Crafted SVG Files
Two critical RCE vulnerabilities in Microsoft Bing Images, patched by Microsoft, allowed attackers to execute OS commands on backend servers using crafted SVG files.
Microsoft's Bing Images service has been the target of two critical remote code execution (RCE) vulnerabilities, CVE-2026-32194 and CVE-2026-32191, which allowed attackers to gain control over backend image-processing servers. These flaws, discovered by the AI security researcher XBOW, leveraged command injection within the image-processing pipeline accessible through the 'Search by Image' feature. Microsoft has since patched these vulnerabilities, which carried a maximum CVSS score of 9.8.
The primary vulnerability, CVE-2026-32194, exploited a command injection flaw in Bing's image-processing pipeline. Attackers could trigger this by uploading a specially crafted Scalable Vector Graphics (SVG) file through the public 'Search by Image' upload feature. A related flaw, CVE-2026-32191, affected a similar server-side image ingestion path used by Bing's reverse image search crawler, allowing exploitation through an attacker-controlled URL.
Exploitation began with a Server-Side Request Forgery (SSRF) pattern, where Bing's reverse image search could be tricked into fetching an attacker-controlled URL from its backend. Researchers observed anomalous HTTP 500 errors, indicating that the backend was processing the fetched content beyond simple image retrieval. Further investigation revealed that the image conversion library was vulnerable to SVG parsing, which, due to SVG's XML-based nature, could embed malicious commands.
By embedding pipe-prefixed shell commands within an SVG reference, attackers could trick the image conversion library into executing these commands as operating system commands on the server, rather than rendering them as images. This exploit could be delivered either through direct upload or via the crawler-based SSRF route, both leading to the same vulnerable processing pipeline.
Proof of exploitation was confirmed through out-of-band callbacks, as the frontend returned generic errors while the backend silently executed commands. Command output verified successful execution as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter instances, and researchers also confirmed exploitation on Linux-based workers, indicating a widespread exposure across Bing's image-processing infrastructure.
This type of vulnerability, command injection through image converters, is not new and has been seen in previous exploits like ImageTragick. However, the significance of this discovery lies in how attackers weaponized image parsers, often treated as inert components, to achieve critical system access. The findings highlight the inherent risks when applications treat image parsers as trusted components rather than security-critical code.
Microsoft has fully remediated these vulnerabilities in its cloud service. The incident serves as a crucial reminder for organizations to secure their own image-processing pipelines by disabling shell-invoking delegates, enforcing restrictive policy configurations, implementing strict egress controls, and running image conversion in sandboxed environments with reduced privileges and network access.