Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
Two critical CVEs in Bing's image search pipeline allowed crafted SVGs to execute commands as SYSTEM on Windows and root on Linux workers, both rated 9.8 on the CVSS scale.
Intelligence analysis by Llama
XBOW disclosed two ImageMagick delegate command-injection flaws in Bing's image-processing tier, reachable without authentication via the public 'Search by Image' upload and the bingbot crawler route. Microsoft patched server-side before March advisories; the case is a textbook reminder that image converters are parsers, not plumbing.
Imagine a mailroom that opens every package and then asks a helper robot to look inside. A sneaky envelope told the robot to also run a secret instruction, and the robot had the keys to the whole building. Microsoft has since changed the locks on that mailroom, but anyone else still using the same kind of helper robot should turn off its 'follow instructions from strangers' setting right away.
Analysis
Two doors into the same conversion tier
The most striking thing about the Bing disclosure is how ordinary the surface looked. The first entry point, CVE-2026-32194, sits behind a public endpoint: the imageBin field of /images/kblob, which accepts a base64-encoded SVG with no authentication, cookies, or session state. The second, CVE-2026-32191, is even more passive — hand bingbot a URL to an SVG through the imgurl parameter, and the crawler fetches it and drops it into the same downstream pipeline. Neither route required a click from a victim, which is what pushed the CVSS scores to 9.8. The damage stops at the worker, but the worker was SYSTEM on Windows Server 2022 Datacenter and uid=0 on Linux, with SeImpersonatePrivilege and SeDebugPrivilege enabled — a textbook staging ground for lateral movement if the issue had been weaponised before the fix.
The bug was in the helper, not the homepage
The disclosure is worth reading as a case study in misclassified attack surface. The application believed it was processing an image; the helper underneath parsed part of that image as a command. SVGs are XML, not pixels, and a renderer that follows the references inside one is effectively a tiny web crawler attached to whatever invoked it. ImageMagick's delegate system — the long-standing mechanism that hands formats it does not handle natively to external programs via a shell — is the part that turned a fetch into code execution. A reference beginning with a pipe character was interpreted as a shell command rather than a filename, and the one-pixel SVG payload curled its output back to an XBOW-controlled collector. The error response to the browser was a 500, which made the bug look like a dead end; the worker kept running anyway.
What every other team should do this week
The defensive advice in the writeup is concrete enough to copy straight into a runbook. ImageMagick's own documentation states the default policy is meant for sandboxed or firewalled use, not for a public website — and yet the same defaults keep showing up on production workers. Denying delegates outright via policy.xml is the single highest-leverage change: <policy domain="delegate" rights="none" pattern="*" />. From there, cut the formats you accept (SVG, MVG, and EPS are the usual suspects), disable anything in delegates.xml that is enabled by default and not needed, run conversion sandboxed and with reduced privileges, and block outbound network from the worker. The last item is the one that turned a blind bug into a proven one — without an exfiltration path, the same SVG would have been nothing more than a noisy log line. ImageTragick in 2016 was the same class of failure, and as XBOW CISO Nico Waisman put it, applications still treat image helpers as plumbing while attackers treat them as parsers.
Key points
- Two CVEs (CVE-2026-32194 and CVE-2026-32191), both rated 9.8, allowed unauthenticated SVG-based command injection in Bing's image-processing tier, running as SYSTEM on Windows and root on Linux.
- Reachable through the public /images/kblob upload endpoint and via the bingbot crawler route (imgurl parameter), with no login, cookies, or user interaction required.
- Root cause was ImageMagick's delegate mechanism, the same class of failure as the 2016 ImageTragick bug, interpreting an SVG image reference as a shell command.
- Microsoft fixed the issues server-side before publishing advisories on March 19 and lists no customer action; XBOW published mechanics on July 23 at Microsoft's request.
- Defenders using ImageMagick should deny delegates in policy.xml, restrict accepted formats, sandbox conversion, and block outbound network from image workers.
The same delegate-based command-injection class has been public since ImageTragick in 2016, and the Bing case shows it still ships in default configurations on high-value production workers. As long as ImageMagick's permissive defaults remain the path of least resistance, the next CVE in this family is a matter of when, not if, and it is plausible that less-disciplined deployments than Bing's have been quietly compromised before anyone noticed the 500s.
