Microsoft has assigned two critical CVEs — CVE-2026-32194 and CVE-2026-32191 — to vulnerabilities in Bing’s image-processing infrastructure, each with a CVSS 9.8 score. According to researchers from XBOW, a specially crafted SVG file uploaded via image search made it possible to execute arbitrary commands on the processing servers — both on Windows (with NT AUTHORITY\SYSTEM privileges) and on Linux (with root privileges). Microsoft remediated both vulnerabilities on the server side before the advisories were published in March; no action is required from users. Public PoC code has been available since July 23.
Technical details of the vulnerabilities
Both vulnerabilities affect Bing’s image-processing pipeline and exploit the same mechanism: delegating the handling of formats to external programs via the shell, a pattern typical of ImageMagick and compatible libraries. However, they have different entry points:
- CVE-2026-32194 (CWE-77, command injection) — exploited via the public “Search by image” function: the SVG file is passed in base64 encoding in the
imageBinfield to the/images/kblobendpoint. - CVE-2026-32191 (CWE-78, OS command injection) — exploited via the crawler: the attacker hosts an SVG on any server and passes its URL via the
imgurlparameter, after whichbingbot/2.0downloads the file into the same processing pipeline.
According to the researchers, neither vector required authentication, cookies, session state, or user interaction. Microsoft classified both vulnerabilities as critical and, as of the advisory publication date of March 19, reported no public disclosure or exploitation in the wild.
Exploitation mechanics: from “dead” SSRF to shell
As XBOW describes, the initial finding looked like a blind SSRF: reverse image search fetched a URL from the backend, but the result was not returned to the client. The indicator was the behavior of some workers, which responded with HTTP 500 yet continued to download and process the retrieved content.
The key turned out to be the SVG format. It is XML, not raster pixels — an SVG can contain references to other images. When the renderer follows such references, it passes formats it cannot handle itself to a delegate — an external program invoked via the shell. Along the path the researchers discovered, delegates were enabled, and an image reference starting with a pipe character (|) was interpreted by the shell as a command rather than a filename.
The payload was a one-pixel SVG whose image reference executed a command on the worker and sent the output via curl to an external collector. According to XBOW, on Linux workers the commands returned uid=0 and gid=0, and on Windows, systeminfo reported Windows Server 2022 Datacenter, while whoami /all showed SeImpersonatePrivilege and SeDebugPrivilege. XBOW states that it executed only safe read-only commands and did not access user data.
It is important to note: the exploitation details and privilege level are described by XBOW’s researchers and are not independently confirmed in Microsoft’s advisories, which only record the vulnerabilities as critical.
Context: ImageMagick delegates as a chronic problem
This class of vulnerabilities is not new. In 2016, ImageTragick (CVE-2016-3714) demonstrated the same issue: ImageMagick delegates allowed command injection through image processing. Ten years later, the pattern repeats — image converters still are not treated as part of the attack surface.
As XBOW CISO Nico Waisman noted: “Applications treat image processors like plumbing. Attackers treat them like parsers.” The official ImageMagick security documentation explicitly states that the default policy is open and intended for isolated or environment-protected setups, not for public services processing untrusted files.
Impact assessment
Although the issue has been fixed for Bing specifically, the pattern described is relevant to any organization whose image-processing pipeline accepts user-supplied files or downloads images from external URLs. Those at highest risk include:
- Web applications with image upload and conversion functionality
- Reverse image search services and crawlers
- Server-side preview and thumbnail generation systems
- Any pipelines using ImageMagick or compatible libraries with delegates enabled
Bing’s pipeline exhibited three critical issues at once: the handler of untrusted files had access to the shell, ran with maximum privileges, and had outbound internet access. This combination of factors turned a blind vulnerability into full remote code execution with confirmation.
Practical recommendations
For organizations that use ImageMagick or compatible libraries to process untrusted images:
- Disable delegates in
policy.xml:<policy domain="delegate" rights="none" pattern="*" /> - Restrict accepted formats. SVG, MVG, and EPS can contain references and interpreter invocations — exclude them if they are not critical to your business logic.
- Review
delegates.xmland disable all delegates that are not used. - Run conversions in a sandbox with minimal privileges — not as root and not as SYSTEM.
- Block outbound network access from image-processing workers. It is outbound connectivity that turns a blind vulnerability into confirmed exploitation.
- Restrict server-side downloads using a whitelist of allowed addresses, excluding internal networks.
To verify which policies are actually loaded, use the command magick identify -list policy.
The Bing case is a practical demonstration that an image converter running with elevated privileges, shell access, and outbound internet connectivity is a fully fledged remote code execution vector. If your image-processing pipeline handles untrusted content, review your ImageMagick delegate configuration and the network isolation of your workers today, rather than waiting for the ImageTragick scenario to repeat in your infrastructure.
