Two Critical Vulnerabilities in Bing: Command Execution as SYSTEM and Root via Malicious SVGs

Introduction

On July 23, 2026, researchers from XBOW publicly disclosed technical details of two critical vulnerabilities affecting Microsoft Bing, identified as CVE-2026-32191 and CVE-2026-32194. With a CVSS score of 9.8, these flaws allowed a remote attacker to execute arbitrary commands with the highest system privileges — NT AUTHORITY\SYSTEM on Windows Server and root on Linux — simply by sending a specially crafted SVG image to the search engine's processing pipeline. Microsoft resolved both issues on the server side well before the advisory was published (on March 19, 2026), requiring no action from end users. Public disclosure was delayed until all mitigations were in place.

Technical Analysis

The root of the vulnerability lay in Bing's image conversion pipeline, which relied on ImageMagick (or compatible components). To handle complex formats like SVG, ImageMagick uses “delegates”: external programs invoked to process specific content. In this context, a reference inside the SVG file was interpreted by the delegate as a command to execute, leading to a classic command injection (CWE-77/CWE-78).

The two CVEs differed in their attack vectors:

• CVE-2026-32194: exploitable through Bing’s “Search by Image” feature, which accepts direct uploads. Sending a malicious SVG was enough to achieve code execution on the processing worker.
• CVE-2026-32191: based on providing a URL to the bingbot crawler. An attacker could simply supply a link to a hostile SVG, with no authentication or user interaction required.

In both cases, the injected command ran with maximum operating system privileges, granting full control over the compromised machine. During the demonstration, XBOW ran read-only commands, but the nature of the flaw imposed no real restrictions.

Impact

The potential impact was critical for the entire Microsoft infrastructure. An attacker could have:

• Executed code remotely as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter or as root on Linux.
• Fully compromised Bing’s workers and gained access to the internal network, moving laterally to other services.
• Installed backdoors, established persistence, and exfiltrated sensitive information. The attack surface involved the search engine’s production servers, but also any environment using an insecure ImageMagick configuration.

Mitigation

For Bing users, no action is required: Microsoft applied the fix to its own servers as early as March 2026. However, for systems that use ImageMagick to process untrusted images, it is essential to adopt the following hardening measures:

• Disable unnecessary delegates via policy.xml using the rule <policy domain="delegate" rights="none" pattern="*" />.
• Restrict accepted formats, excluding SVG, MVG, EPS, and any other format that can contain interpretable external references.
• Run the conversion inside a sandboxed environment with reduced privileges and network isolation.
• Block outbound traffic from workers, allowing only strictly necessary communications.
• Check the active configuration with the command magick identify -list policy. The default ImageMagick configuration is not considered safe for publicly exposed services; every installation must be carefully reviewed.

FAQ

1. How severe are the CVE-2026-32191 and CVE-2026-32194 vulnerabilities?
Both received a CVSS score of 9.8 (Critical). They allowed remote command execution with the highest system privileges without requiring authentication or interaction, exposing Microsoft servers to full control.

2. Is Bing still at risk? Do I need to do anything as a user?
No. Microsoft fixed the server-side vulnerabilities before March 19, 2026, completing the necessary mitigations. Bing users do not need to take any action: the service is now protected.

3. How can I secure my own server that uses ImageMagick to process third-party uploaded images?
To prevent similar attacks, you must disable delegates, limit accepted formats (excluding SVG, MVG, EPS, and the like), confine the conversion process in a sandbox with minimal privileges, and block outbound network traffic. It is also critical to test the configuration with magick identify -list policy to ensure that the restrictive policies are actually active.