[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIr9tBwWAlF7MX3ouY4wE4Y4fEeKBnUBt5viJr55ZXJE":3},{"article":4,"iocs":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":30,"category":31,"article_tags":35},"13016a28-8c7c-4327-a8ea-1892a0a172ce","Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers","bing-images-flaws-let-crafted-svgs-run-commands-as-system-on-microsoft-s-servers-3f283a","A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and","Microsoft patched two critical CVEs (CVE-2026-32194 and CVE-2026-32191) affecting Bing Images that allowed attackers to run arbitrary commands as NT AUTHORITY\\SYSTEM on Windows and root on Linux image-processing workers via malicious SVG files. Security firm XBOW discovered the flaws, which exploited ImageMagick delegate functionality and shell command injection; Microsoft fixed both server-side before disclosure in March 2026, and XBOW published exploit details in July 2026.","Crafted SVGs in Bing Images triggered command execution as SYSTEM\u002Froot on Microsoft servers.","Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers Swati KhandelwalJul 24, 2026Vulnerability \u002F Web Security A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and CVE-2026-32191, and rated both 9.8 on the CVSS scale. XBOW, the autonomous offensive security startup, found both and reported them privately. Bing users have no patch or mitigation to apply: Microsoft fixed both server-side before the advisories went out in March, and the records state there is \"no customer action to resolve.\" Neither advisory recorded exploitation or public disclosure when they went up on March 19. XBOW published the exploit mechanics on July 23, after holding them back at Microsoft's request until the remediation had landed. What outlives the fix is the shape of the bug. The application believed it was handling an image; the helper underneath read part of that image as a command. If your own stack pipes uploads or server-fetched URLs through ImageMagick or anything ImageMagick-compatible, your exposure turns on whether attacker-controlled content can still reach a delegate-enabled path. Deny the delegates, cut the formats you accept, and keep the worker off the network, and the same SVG does nothing. Bing's reverse image search fetches an image URL from the backend, because that is what the feature does. On its own, that is a blind SSRF: nothing comes back to the client. The tell was the error. Some workers returned a 500 to the browser and still fetched and parsed what they retrieved, which pointed at something downstream doing the parsing. SVG answered that question. It is XML, not pixels: it can reference other images, and a renderer that follows those references goes and gets them. Underneath, conversion suites hand formats they do not process themselves to a delegate, an external program invoked through a shell. On the path XBOW reached, that layer was still enabled, so an image reference beginning with a pipe character went to the shell rather than being read as a filename. The payload was a one-pixel SVG whose reference ran a command on the worker and curled the output back to a collector XBOW controlled. That gave two routes into the same conversion tier and two CVEs. CVE-2026-32194, filed as command injection under CWE-77, is the public \"Search by Image\" upload, with the SVG going in base64 as the imageBin field to \u002Fimages\u002Fkblob. CVE-2026-32191, filed as OS command injection under CWE-78, is the crawler route: host the SVG anywhere, hand its URL to the search through the imgurl parameter, and bingbot\u002F2.0 fetches it into the same pipeline. Neither needs authentication, cookies, session state or a click. The Hacker News checked both CVE records on July 24. Both still carry Microsoft's March status of no public disclosure, which XBOW's writeup has overtaken, and Microsoft still lists them as not exploited. The proof had to come out of band. The frontend could return an error while the worker executed anyway. Linux workers returned uid=0 and gid=0. On Windows, systeminfo named Windows Server 2022 Datacenter, whoami \u002Fall showed SeImpersonatePrivilege and SeDebugPrivilege enabled, and directory listings put execution inside Bing's multimedia image-processing components. The firm says it ran only benign read-only commands and touched no customer data. Narrowing it to that path took dozens of probes. ImageMagick pseudo-protocols came back differently depending on the coder: label: rendered text and xc: produced a color image, while text:, caption: and direct file reads failed. Shell metacharacters inside label: rendered as text rather than executing, which ruled that coder out. The path that did reach a delegate was the image reference inside the SVG itself. Turn the delegates off An image-processing worker handling untrusted files should not reach a shell, run as SYSTEM, or have a way out to the internet. Bing's pipeline did all three. ImageMagick's own guidance is explicit that the default policy is open and meant for sandboxed or firewalled use, not a public website. For anything touching untrusted images, deny delegates outright in policy.xml: \u003Cpolicy domain=\"delegate\" rights=\"none\" pattern=\"*\" \u002F> Then, in order of what buys you most: Cut the formats you accept. SVG, MVG and EPS are among those that carry references and interpreters. Review delegates.xml and disable anything enabled that you do not need. Run conversion sandboxed and with reduced privileges. Block outbound network from the worker, which is the leg that turned a blind bug into a proven one. Allowlist the destinations a server-side fetch may reach, and keep the worker off internal addresses. ImageMagick's guidance is to test after any policy change, and magick identify -list policy prints what is actually loaded. ImageTragick, the 2016 delegate command injection tracked as CVE-2016-3714, is the same class of failure, and it keeps resurfacing because nobody counts the converter as part of the attack surface. XBOW CISO Nico Waisman, who wrote the disclosure, put it this way: \"Applications treat image helpers as plumbing. Attackers treat them as parsers.\" The fetch was reachable, returned nothing, and looked like a dead end. What turned it into a SYSTEM shell was the parser behind it, and nothing in the response would have told you so. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, Command Injection, linux, Microsoft, remote code execution, Vulnerability, Web Security, Windows Security ⚡ Top Stories This Week URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code ⭐ Featured Resources What Security Teams Must Defend in the New AI Software Supply Chain Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fbing-images-flaws-let-crafted-svgs-run.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEirbs2h3QyfDG1ChFBHv8CQNwf9JrDdDWLaZ0AZ2WTiJrsjmmeQUXSFc8FM4OvPgxDig-z2H1Di7OMqCC_0mHbicAvDw6TGF-1jWihJ458GYQBKznb3VOehlOPqWfALnkz8k3DBfehWG2z5nmpu77OgRxJ1iQxL7lsrd1IH3YR6ZHPpSUns-tdmDYScHck\u002Fs1600\u002Fbing-image.jpg","2026-07-24T11:45:17+00:00","2026-07-24T14:00:23.468841+00:00",9,[18,21,24,27],{"name":19,"type":20},"Microsoft","vendor",{"name":22,"type":23},"Bing Images","product",{"name":25,"type":26},"XBOW","threat_actor",{"name":28,"type":29},"ImageMagick","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-32194","Command injection via base64-encoded SVG in \u002Fimages\u002Fkblob upload endpoint (CWE-77)",{"type":53,"value":57,"context":58},"CVE-2026-32191","OS command injection via imgurl parameter in reverse image search crawler (CWE-78)"]