{"id":14567,"date":"2026-07-25T10:03:38","date_gmt":"2026-07-25T10:03:38","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/25\/bing-images-vulnerability-lets-attackers-execute-remote-code-on-microsoft-servers\/"},"modified":"2026-07-25T10:03:38","modified_gmt":"2026-07-25T10:03:38","slug":"bing-images-vulnerability-lets-attackers-execute-remote-code-on-microsoft-servers","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/25\/bing-images-vulnerability-lets-attackers-execute-remote-code-on-microsoft-servers\/","title":{"rendered":"Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers"},"content":{"rendered":"

Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Three critical remote code execution (RCE) vulnerabilities in Microsoft\u2019s infrastructure, with two flaws in Bing Images allowing attackers to hijack backend image-processing servers using nothing more than a crafted SVG file.<\/p>\n

The findings, disclosed responsibly by XBOW and now patched, expose how an \u201cordinary\u201d image-handling feature became a gateway to full SYSTEM-level access on production Bing servers.<\/p>\n

Microsoft\u2019s advisories classify all three vulnerabilities as Critical, each carrying a maximum CVSS score of 9.8. CVE-2026-32194<\/a> is a command injection flaw in Bing\u2019s image-processing pipeline, reachable through the public \u201cSearch by Image\u201d upload feature.<\/p>\n

Its sibling, CVE-2026-32191<\/a>, affects a related server-side image ingestion path tied to Bing\u2019s reverse image search crawler. A third, unrelated flaw, CVE-2026-21536<\/a>, involves unrestricted file upload in the Microsoft Devices Pricing Program.<\/p>\n

\n
\"Bing
Bing Images visual search endpoint investigation (Image Source: xbow.com)<\/figcaption><\/figure>\n<\/div>\n

All three were credited to XBOW, an autonomous AI security researcher that reportedly landed in the top 10 of Microsoft\u2019s bug bounty leaderboard as the first AI to achieve that rank.<\/p>\n

\n\n\n\n\n\n\n\n
CVE Identifier<\/strong><\/td>\nAffected Component<\/strong><\/td>\nRoot Cause Mechanism<\/strong><\/td>\n<\/tr>\n<\/thead>\n
CVE-2026-32194<\/strong><\/td>\nBing \u201cSearch by Image\u201d upload<\/td>\nCommand injection in image-processing pipeline<\/td>\n<\/tr>\n
CVE-2026-32191<\/strong><\/td>\nBing reverse image search (crawler fetch)<\/td>\nOS command injection in server-side image ingestion<\/td>\n<\/tr>\n
CVE-2026-21536<\/strong><\/td>\nMicrosoft Devices Pricing Program<\/td>\nUnrestricted upload of executable files<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

The investigation began almost by accident: Bing\u2019s reverse image search could be tricked into fetching an attacker-controlled URL from its backend, a classic server-side request forgery (SSRF) pattern that on its own looked low-impact.<\/p>\n

Researchers confirmed the fetch by observing outbound requests from Bing infrastructure carrying a bingbot\/2.0 user agent, then noticed inconsistent HTTP 500 errors that hinted the backend was doing more than just retrieving an image.<\/p>\n

That anomaly led investigators to test whether the fetched content was being parsed by a vulnerable component rather than simply displayed.<\/p>\n

Systematic probing ruled out XML External Entity (XXE) attacks and instead pointed to an ImageMagick-style rendering engine processing SVG files through \u201ccoders\u201d and \u201cdelegates.\u201d<\/p>\n

Because SVG is XML-based, it can embed references to external resources or execute pseudo-protocols like label:, xc:, and pipe-based commands, features useful for trusted input but dangerous when exposed to public uploads.<\/p>\n

The successful payload inserted a pipe-prefixed shell command within an SVG reference, which led the backend\u2019s image conversion library to execute it as an operating system command instead of rendering it as an image.<\/p>\n

This SVG was submitted either directly through Bing\u2019s image upload endpoint or hosted externally and pulled in via the crawler-based SSRF path, two distinct routes into the same vulnerable delegate-backed pipeline.<\/p>\n

\n
\"Trace
Trace logs analyzing ImageMagick delegate vectors (Image Source: xbow.com)<\/figcaption><\/figure>\n<\/div>\n

Proof of exploitation arrived via out-of-band callbacks rather than the visible HTTP response, since the frontend returned generic errors while the backend silently executed commands.<\/p>\n

Command output confirmed execution as NT AUTHORITYSYSTEM on Bing image-processing workers running Windows Server 2022 Datacenter, with results reproduced across multiple hosts and network ranges indicating the exposure spanned Bing\u2019s image-processing tier, not a single misconfigured server.<\/p>\n

XBOW researchers<\/a> also caught Linux-based workers, initially missed because their automated validator only recognized Linux-style output like uid=0(user) gid=0(group), until they retooled it to also catch Windows proof commands such as whoami \/all and systeminfo.<\/p>\n

This is not a novel bug; command injection<\/a> through image converters has plagued software for years, as seen in ImageTragick and similar ExifTool-based RCEs disclosed via GitLab\u2019s bug bounty program.<\/p>\n

What made this case notable was that applications treat image parsers as inert \u201cplumbing,\u201d when in reality these helpers carry decades of format compatibility and shell-out behavior that attackers can weaponize.<\/p>\n

Takeaway for Defenders<\/strong><\/h2>\n

Organizations running similar image-processing pipelines should take several precautions:<\/p>\n