Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
Summary: XBOW found that a crafted SVG submitted to Bing's image search executed commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers and as root on Linux machines in the same fleet, with the same result across different hosts and network ranges. Microsoft issued two critical CVEs, CVE-2026-32194 and CVE-2026-32191, both rated 9.8 on CVSS, fixed server-side before the March advisories, and XBOW published the exploit mechanics on July 23 after holding them at Microsoft's request.
Why it matters: The bug worked because an image reference beginning with a pipe character reached a delegate-enabled shell, and ImageMagick's default policy is open - so if your stack pipes uploads or server-fetched URLs through ImageMagick or anything compatible, the same one-pixel SVG is a question of configuration, not of whether you are a target.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-32191CVE-2026-32194
- Related
- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026