Full Report
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and
Analysis Summary
# Vulnerability: Remote Code Execution in Bing Image Processing Tier
## CVE Details
- **CVE ID:** CVE-2026-32194 (Command Injection) and CVE-2026-32191 (OS Command Injection)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-77 (Command Injection), CWE-78 (OS Command Injection)
## Affected Systems
- **Products:** Microsoft Bing (Production Image-Processing Infrastructure)
- **Versions:** Cloud-based service (Fixed server-side by Microsoft)
- **Configurations:** Systems utilizing ImageMagick or similar conversion suites with "delegates" enabled for processing untrusted SVG/image uploads or fetches.
## Vulnerability Description
The vulnerability stems from the way Bing’s image-processing tier handled Scalable Vector Graphics (SVG). When an SVG was submitted via upload or URL, the backend processing engine—likely utilizing ImageMagick or a compatible suite—would encounter image references within the XML.
Because the "delegate" feature (which hands off processing for specific formats to external shell commands) was enabled, attackers could prepend a pipe character (`|`) to an image reference. The renderer interpreted the string as a shell command rather than a filename, leading to Remote Code Execution (RCE). This allowed commands to run with high privileges: `NT AUTHORITY\SYSTEM` on Windows Server 2022 hosts and `root` on Linux-based workers.
## Exploitation
- **Status:** PoC developed by XBOW (Reported privately; write-up published July 23, 2026).
- **Complexity:** Low (No authentication or user interaction required).
- **Attack Vector:** Network (Remote).
- **CVE-2026-32194:** Triggered via base64 encoded SVG in the `imageBin` field of the `/images/kblob` endpoint.
- **CVE-2026-32191:** Triggered via a hosted SVG URL passed to the `imgurl` parameter (crawled by `bingbot/2.0`).
## Impact
- **Confidentiality:** Total (Full system access, though researchers reported only read-only tests).
- **Integrity:** Total (Ability to run commands as SYSTEM/root).
- **Availability:** Total (Potential for complete system takeover or service disruption).
## Remediation
### Patches
- **Microsoft Managed:** Microsoft has implemented server-side fixes. No customer action is required for Bing users.
- **On-Premise/Custom Suites:** Ensure ImageMagick or similar libraries are updated and strictly configured.
### Workarounds
- **Disable Delegates:** In ImageMagick, modify the `policy.xml` to deny delegates: `<policy domain="delegate" rights="none" pattern="*" />`.
- **Restrict Formats:** Limit the types of files accepted to the bare minimum (e.g., PNG, JPEG only).
- **Network Isolation:** Ensure image-processing workers are sandboxed and have no outbound internet access.
## Detection
- **Indicators of Compromise:** Unusual outbound traffic from image-processing workers (e.g., `curl` requests to unknown external IPs), and 500 errors coinciding with requests containing pipe characters in SVG XML.
- **Detection Methods:** Monitor for shell execution (`cmd.exe`, `/bin/sh`) initiated by image-processing parent processes.
## References
- Microsoft Security Response Center (CVE-2026-32194): hxxps://msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-32194
- Microsoft Security Response Center (CVE-2026-32191): hxxps://msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-32191
- XBOW Research Blog: hxxps://xbow[.]com/blog/bing-images-rce-vulnerabilities
- ImageMagick Security Policy: hxxps://imagemagick[.]org/security-policy/