Bing Image Search Flaw Allowed Remote Code Execution as SYSTEM
A critical vulnerability in Bing Images enabled attackers to execute arbitrary commands with highest privileges on Microsoft's backend servers. The issue stemmed from unsafe processing of user-submitted SVG files.
TL;DR
- Attackers exploited SVG parsing in Bing Images to run commands as SYSTEM and root.
- Vulnerability affected multiple hosts, indicating a systemic issue in the image tier.
- Microsoft patched the flaw and assigned CVE-2026-32194.
- Exploitation required only submitting a crafted SVG via image search.
- Organizations should audit image-processing pipelines for similar risks.
Security researchers discovered a severe vulnerability in Microsoft's Bing Images service that allowed malicious actors to execute arbitrary commands with the highest system privileges. By submitting specially crafted SVG files, attackers could compromise backend image-processing servers running as NT AUTHORITY\SYSTEM on Windows and root on Linux.
The issue was not limited to a single misconfigured server. Extensive testing confirmed that the flaw existed across multiple hosts and network segments within Bing’s infrastructure, pointing to a fundamental weakness in how the service handled untrusted image inputs.
Technical Breakdown
- The vulnerability resided in the image-processing pipeline used by Bing Images to handle user-submitted SVG files.
- Malicious SVGs triggered command execution with full SYSTEM privileges on Windows workers and root on Linux nodes.
- Tests showed consistent exploitation across different hosts, confirming the flaw was architectural rather than environmental.
- No user interaction beyond uploading or linking an SVG was required for exploitation.
Impact and Response
- Microsoft responded by issuing CVE-2026-32194 and deploying patches to affected systems.
- The flaw highlights risks in automated media processing without proper sandboxing or input sanitization.
- Organizations using third-party or internal image-processing services should review their attack surface.
- Similar vulnerabilities could exist in other platforms relying on untrusted vector graphics rendering.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.