A crafted SVG uploaded to Bing's image search executed commands as NT AUTHORITY\SYSTEM on Microsoft’s production image‑processing workers and as root on the Linux machines in the same fleet. Microsoft responded by issuing two critical CVEs.
Key Takeaways
- A crafted SVG can run system‑level commands on Bing's image‑search backend.
- The flaw affected both Windows and Linux image‑processing workers.
- Microsoft released CVE‑2026‑32194 and CVE‑2026‑32195 to remediate the issue.
A specially crafted SVG submitted to Bing's image search triggered command execution as NT AUTHORITY\\SYSTEM on Microsoft’s production image‑processing workers, while the same file achieved root privileges on the fleet's Linux machines.
Incident Details
Security researchers at XBOW reproduced the exploit across multiple hosts and network ranges, confirming the vulnerability resided in Bing's image tier rather than a single compromised machine. Consequently, every worker in the image‑processing pipeline was potentially exploitable.
Historical Background
SVG (Scalable Vector Graphics) was originally intended for vector‑based graphics rendering, yet past research has demonstrated that improperly sanitized SVG files can execute JavaScript or even launch system commands. A similar flaw in 2019 exposed numerous web applications, highlighting the need for robust SVG sanitization.
Why This Matters
BozokMedia analysis shows that compromising image‑processing pipelines can give attackers a foothold in cloud‑based services, potentially exposing user data and enabling lateral movement across corporate networks.
"The ability to run code as SYSTEM on a cloud service is a severe breach of trust," says cybersecurity researcher Dr. Aisha Khan.
Frequently Asked Questions
- What systems were affected? Both Windows and Linux image‑processing workers in Bing's infrastructure were vulnerable.
- How can organizations protect themselves? Implement strict SVG sanitization and monitor for anomalous command execution.
