Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers

Three critical remote code execution (RCE) vulnerabilities in Microsoft’s infrastructure, with two flaws in Bing Images allowing attackers to hijack backend image-processing servers using nothing more than a crafted SVG file.

The findings, disclosed responsibly by XBOW and now patched, expose how an “ordinary” image-handling feature became a gateway to full SYSTEM-level access on production Bing servers.

Microsoft’s advisories classify all three vulnerabilities as Critical, each carrying a maximum CVSS score of 9.8. CVE-2026-32194 is a command injection flaw in Bing’s image-processing pipeline, reachable through the public “Search by Image” upload feature.

Its sibling, CVE-2026-32191, affects a related server-side image ingestion path tied to Bing’s reverse image search crawler. A third, unrelated flaw, CVE-2026-21536, involves unrestricted file upload in the Microsoft Devices Pricing Program.

All three were credited to XBOW, an autonomous AI security researcher that reportedly landed in the top 10 of Microsoft’s bug bounty leaderboard as the first AI to achieve that rank.

The investigation began almost by accident: Bing’s reverse image search could be tricked into fetching an attacker-controlled URL from its backend, a classic server-side request forgery (SSRF) pattern that on its own looked low-impact.

Researchers confirmed the fetch by observing outbound requests from Bing infrastructure carrying a bingbot/2.0 user agent, then noticed inconsistent HTTP 500 errors that hinted the backend was doing more than just retrieving an image.

That anomaly led investigators to test whether the fetched content was being parsed by a vulnerable component rather than simply displayed.

Systematic probing ruled out XML External Entity (XXE) attacks and instead pointed to an ImageMagick-style rendering engine processing SVG files through “coders” and “delegates.”

Because SVG is XML-based, it can embed references to external resources or execute pseudo-protocols like label:, xc:, and pipe-based commands, features useful for trusted input but dangerous when exposed to public uploads.

The successful payload inserted a pipe-prefixed shell command within an SVG reference, which led the backend’s image conversion library to execute it as an operating system command instead of rendering it as an image.

This SVG was submitted either directly through Bing’s image upload endpoint or hosted externally and pulled in via the crawler-based SSRF path, two distinct routes into the same vulnerable delegate-backed pipeline.

Proof of exploitation arrived via out-of-band callbacks rather than the visible HTTP response, since the frontend returned generic errors while the backend silently executed commands.

Command output confirmed execution as NT AUTHORITY\SYSTEM on Bing image-processing workers running Windows Server 2022 Datacenter, with results reproduced across multiple hosts and network ranges indicating the exposure spanned Bing’s image-processing tier, not a single misconfigured server.

XBOW researchers also caught Linux-based workers, initially missed because their automated validator only recognized Linux-style output like uid=0(user) gid=0(group), until they retooled it to also catch Windows proof commands such as whoami /all and systeminfo.

This is not a novel bug; command injection through image converters has plagued software for years, as seen in ImageTragick and similar ExifTool-based RCEs disclosed via GitLab’s bug bounty program.

What made this case notable was that applications treat image parsers as inert “plumbing,” when in reality these helpers carry decades of format compatibility and shell-out behavior that attackers can weaponize.

Takeaway for Defenders

Organizations running similar image-processing pipelines should take several precautions:

• Disable shell-invoking delegates and pipe-based delegate behavior in ImageMagick-style converters.
• Enforce restrictive policy.xml and delegates.xml configurations, disallowing high-risk formats like SVG, MVG, and EPS unless explicitly required.
• Implement strict egress controls, including destination allowlists and internal-address blocking, for any feature that fetches user-supplied URLs.
• Run image conversion in sandboxed environments with reduced privileges and constrained outbound network access.
• Build validation harnesses that account for heterogeneous server fleets (Linux and Windows) to avoid missing real exploitation signals.

Microsoft has fully remediated both Bing Images vulnerabilities in its cloud service, though the underlying lesson extends well beyond Bing: any application accepting image uploads or fetching external image URLs should treat its conversion pipeline as untrusted, security-critical code rather than harmless media handling