Bing Image Processing Executes User-Supplied SVG as SYSTEM
A crafted SVG submitted to Bing Images ran commands as SYSTEM on Microsoft's production image servers. CVE-2026-32194 (CVSS 9.8) is now patched.
- Vendor
- Microsoft
- Product
- Bing Image Processing Infrastructure
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.2%
- Status
- patched
- Published
Is CVE-2026-32194 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-32194 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.2% (scored November 5, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-32194 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Microsoft’s Bing image search processed user-supplied SVG files inside a worker process running as NT AUTHORITY\SYSTEM on Windows and as root on Linux. Security firm XBOW reported that a crafted SVG could execute arbitrary commands in that context across multiple hosts in Bing’s image-processing fleet — the issue was in the tier’s design, not isolated to a single machine.
Microsoft assigned multiple critical CVEs addressing the findings. CVE-2026-32194, rated CVSS 9.8 Critical, covers the primary server-side code execution path on the Windows side. Patches are deployed to Microsoft’s infrastructure. No end-user action is required. Full research detail is available in the XBOW writeup via The Hacker News.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | [ MEDIUM ] | 6.5 | 1.6% | |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 9.9% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% |
