Three critical remote code execution vulnerabilities in Microsoft’s infrastructure have been disclosed, with two flaws specifically affecting Bing Images and allowing attackers to compromise backend image-processing servers using specially crafted SVG files. The Bing Images vulnerability chain enabled unauthorized access to production servers with SYSTEM-level privileges.
Discovered by XBOW, an autonomous AI security researcher, the vulnerabilities were responsibly disclosed to Microsoft and have since been patched. Microsoft classified all three flaws as Critical, each receiving the maximum CVSS score of 9.8. XBOW reportedly became the first AI to reach the top 10 of Microsoft’s bug bounty leaderboard through these discoveries.
What Vulnerabilities Were Discovered?
The first vulnerability, CVE-2026-32194, involves command injection in Bing’s image-processing pipeline, accessible through the public “Search by Image” upload feature. The second flaw, CVE-2026-32191, affects a related server-side image ingestion path connected to Bing’s reverse image search crawler. A third vulnerability, CVE-2026-21536, impacts the Microsoft Devices Pricing Program through unrestricted file upload capabilities.
The investigation began when researchers discovered Bing’s reverse image search could be manipulated into fetching attacker-controlled URLs from its backend, exhibiting classic server-side request forgery patterns. Inconsistent HTTP 500 errors suggested the backend was processing content beyond simple image retrieval.
How Did Attackers Exploit the Flaws?
Systematic testing revealed an ImageMagick-style rendering engine processing SVG files through “coders” and “delegates.” Because SVG files are XML-based, they can embed references to external resources or execute pseudo-protocols like label, xc, and pipe-based commands. These features become dangerous when exposed to public uploads.
The successful exploitation payload inserted a pipe-prefixed shell command within an SVG reference, causing the backend’s image conversion library to execute it as an operating system command rather than rendering it as an image. Attackers could submit malicious SVG files either directly through Bing’s image upload endpoint or host them externally and have them pulled in via the crawler-based SSRF path.
What Systems Were Compromised?
Proof of exploitation arrived through out-of-band callbacks rather than visible HTTP responses, as the frontend returned generic errors while the backend silently executed commands. Command output confirmed execution as NT AUTHORITY\SYSTEM on Bing image-processing workers running Windows Server 2022 Datacenter. The exposure spanned Bing’s image-processing tier across multiple hosts and network ranges, not just a single misconfigured server.
Researchers also identified Linux-based workers that were initially missed because automated validators only recognized Linux-style output. The tools were later retooled to detect Windows proof commands such as whoami /all and systeminfo.
What Should Organizations Do?
Organizations running similar image-processing pipelines should disable shell-invoking delegates and pipe-based delegate behavior in ImageMagick-style converters. They should enforce restrictive policy.xml and delegates.xml configurations, disallowing high-risk formats like SVG, MVG, and EPS unless explicitly required. Additional measures include implementing strict egress controls with destination allowlists, running image conversion in sandboxed environments with reduced privileges, and building validation harnesses that account for heterogeneous server fleets.
Microsoft has fully remediated both Bing Images vulnerabilities in its cloud service. The underlying lesson extends beyond Bing: any application accepting image uploads or fetching external image URLs should treat its conversion pipeline as untrusted, security-critical code.
Source: Cybersecurity News