Bing Image Workers Ran SYSTEM Commands via Crafted SVGs

Bing’s image search ran arbitrary commands as NT AUTHORITY\SYSTEM on Microsoft’s Windows production workers — and as root on the Linux machines in the same fleet — when fed a crafted SVG file. Security firm XBOW published findings on July 23 covering two unauthenticated critical vulnerabilities that handed code execution inside Microsoft’s image-processing infrastructure to anyone with an internet connection and a crafted SVG.

Both issues trace back to the same root cause: ImageMagick’s SVG handling delegates processing through a shell invocation, and a pipe character in user-controlled image paths reached that shell as a command separator rather than as a filename character. The worker process running the result sat under SYSTEM on Windows and as root on Linux — not because of a careless configuration, but because that is what the image-processing tier’s service account was.

The Two CVEs

Microsoft assigned two critical CVEs, both at CVSS 9.8:

CVE-2026-32194 covers the direct upload path. A SVG submitted via the imageBin field at Bing’s /images/kblob endpoint reached ImageMagick processing without sanitizing the injectable content. No authentication required.

CVE-2026-32191 covers the crawler route. An attacker-hosted SVG passed via the imgurl parameter was fetched by bingbot/2.0 and handed to the same pipeline. Also unauthenticated, same execution context.

XBOW confirmed the result on workers across different hosts and network ranges. The problem sat in how the image tier was designed, not on a single misconfigured machine.

Patch and Exposure Window

Microsoft fixed both server-side before its March 19, 2026 advisories. XBOW disclosed publicly on July 23 after the patch was deployed — standard coordinated disclosure. According to Microsoft’s own records as of July 24, neither CVE was publicly known or exploited before the fix. No end-user action is required; the vulnerable code runs entirely on Microsoft’s infrastructure.

The Pattern Behind the Pattern

ImageMagick’s delegate system — shelling out to external programs to handle specific formats — produced exploitable server-side code execution in 2016 as well. ImageTragick (CVE-2016-3714, CVSS 8.4) used the same mechanism: user-controlled input in image paths reaching a shell invocation. The format list changed. The architectural decision to trust delimiter parsing in user-supplied paths didn’t.

The standard mitigations have not changed either: disable delegates in policy.xml, restrict accepted file formats — SVG, MVG, and EPS are the high-risk entries — sandbox conversion processes, and block outbound network access from workers that process external content. For teams running self-managed image processing pipelines that accept user-supplied files and haven’t been audited since original deployment, the XBOW writeup is the current edition of a familiar reminder.

Microsoft’s fix is deployed. The same mistake, different decade.

---

Source: Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers — The Hacker News, July 24, 2026.