XBOW, an autonomous offensive security startup, disclosed two critical remote code execution vulnerabilities in Microsoft Bing’s image processing pipeline. The flaws, tracked as CVE-2026-32194 and CVE-2026-32191, both carry a CVSS score of 9.8. A crafted SVG image could execute arbitrary commands as NT AUTHORITY\SYSTEM on Windows workers and as root on Linux workers inside Microsoft’s production infrastructure. Microsoft patched both server-side before the March 2026 advisories went public, so no customer action is required for Bing users. However, the underlying ImageMagick delegate weakness affects any organization processing untrusted images.
What Happened: XBOW Discovers Bing Images RCE via SVG Command Injection
XBOW discovered the vulnerabilities during autonomous penetration testing of Microsoft’s Bing image search services. Their testing produced code execution on multiple workers across different hosts and network ranges. Consequently, the flaw was systemic rather than isolated to a single misconfigured machine.
Microsoft issued two critical CVEs on March 19, 2026, and rated both 9.8 on the CVSS scale. Neither advisory recorded exploitation or public disclosure at that time. XBOW held back the technical details at Microsoft’s request and published the full exploit mechanics on July 23, 2026.
The root cause lies in how Bing’s image pipeline handled SVG files. An application layer believed it was processing an image. Underneath, a conversion helper passed parts of that image data to a shell delegate. Therefore, attacker-controlled content reached a command interpreter disguised as an image renderer.
Technical Details of the Bing Images Vulnerabilities
The attack chain exploits ImageMagick’s delegate mechanism. When ImageMagick encounters a format it cannot process natively, it hands the file to an external delegate program. By default, this mechanism is wide open. An SVG file can embed references to other resources, and if the renderer follows those references, it may invoke a shell command rather than reading a file.
XBOW’s proof-of-concept used a one-pixel SVG with an image reference beginning with a pipe character. The pipe directed the reference to a shell command instead of a filename. The payload then ran a command on the worker and curled the output back to XBOW’s collector. The frontend sometimes returned a 500 error, yet the worker executed the command anyway.
Two Attack Vectors, Two CVEs
The vulnerabilities provide two independent routes into the same vulnerable conversion tier:
- CVE-2026-32194 (CWE-77, command injection) affects the public “Search by Image” upload path. An attacker base64-encodes a malicious SVG and sends it as the
imageBinfield to the/images/kblobendpoint. - CVE-2026-32191 (CWE-78, OS command injection) affects the reverse image search crawler. An attacker hosts the SVG anywhere and submits its URL through the
imgurlparameter. Bing’s crawler then fetches the SVG and feeds it into the same vulnerable pipeline.
Neither vector requires authentication, cookies, session state, or a user click. Furthermore, both routes reach workers running with elevated privileges. On Windows, whoami /all showed SeImpersonatePrivilege and SeDebugPrivilege enabled. On Linux, execution occurred as uid=0 and gid=0.
How the Shell Was Reached
XBOW probed ImageMagick pseudo-protocols to find the working path. Different coders returned different behaviors: label: rendered text, xc: produced a color image, while text:, caption:, and direct file reads failed. Shell metacharacters inside label: rendered as text rather than executing. Therefore, XBOW ruled out that coder. The working path was the image reference inside the SVG itself, which reached a delegate still enabled in the pipeline.
Business and Operational Impact
Although Microsoft has already patched the Bing-specific flaw, the broader lesson matters for every organization that processes images from untrusted sources. The following categories summarize the key risks:
- Supply chain exposure: Any web application that accepts image uploads or fetches images from user-provided URLs may use ImageMagick or a compatible library under the hood.
- Privilege escalation: Image processing workers often run with elevated privileges or broad network access, turning a parser bug into a full system compromise.
- Silent exploitation: The frontend can return an error while the worker executes the payload in the background. Therefore, application logs may show 500 errors but not reveal successful exploitation.
- Data breach risk: A compromised image worker with outbound internet access can exfiltrate data, load secondary payloads, or pivot into internal networks.
- Third-party liability: SaaS providers and platforms that process user images may be unknowingly exposing their infrastructure through hidden conversion pipelines.
Moreover, the ImageMagick delegate issue is not new. The 2016 ImageTragick vulnerability (CVE-2016-3714) was the same class of failure. It keeps resurfacing because development teams treat image helpers as plumbing rather than attack surface.
Mitigation and Recommendations
Organizations that process untrusted images must harden their conversion pipelines immediately. The following steps provide a prioritized response plan.
Immediate Actions for Defenders
- Audit your image processing stack. Identify any use of ImageMagick, GraphicsMagick, or compatible libraries in your application pipeline.
- Disable all delegates in policy.xml. Add
<policy domain="delegate" rights="none" pattern="*" />to deny delegate execution entirely. - Cut the formats you accept. SVG, MVG, and EPS are among the formats that carry references and interpreters. Restrict uploads to safe formats such as JPEG and PNG unless business needs require otherwise.
- Review delegates.xml and disable anything unnecessary. Remove or comment out delegates for formats you do not need.
- Run conversion sandboxed and with reduced privileges. Never run image workers as root, SYSTEM, or a privileged service account.
- Block outbound network from image workers. Outbound access turned a blind bug into a proven remote shell for XBOW. Firewall image processing hosts from the internet.
- Allowlist destination URLs for server-side fetches. If your application fetches images from URLs, restrict those fetches to known-good domains.
Long-Term Hardening
Beyond the immediate response, security teams should shift how they view image processing. The application layer sees an image upload. The attacker sees a parser with shell access. Therefore, treat every image conversion path as a potential command injection surface.
ImageMagick’s own security guidance is explicit: the default policy is open and intended for sandboxed or firewalled environments. It is not safe for public-facing websites. After any policy change, run magick identify -list policy to verify what is actually loaded. Additionally, conduct regular architecture reviews of file upload and image transformation workflows. Map every path from user input to parser execution, and apply defense in depth at each layer.
Bottom line: If your stack pipes untrusted images through ImageMagick or any compatible converter, disable delegates, restrict formats, sandbox the worker, and cut its network access. The same SVG that owned Bing’s workers can own yours.
Incident Summary
| CVE ID / Incident: | CVE-2026-32194 (command injection, CWE-77) and CVE-2026-32191 (OS command injection, CWE-78) |
| Affected Systems: | Microsoft Bing image search processing workers (server-side, now patched); any organization using ImageMagick or compatible libraries to process untrusted images |
| Disclosure Date: | March 19, 2026 (Microsoft advisories); July 23, 2026 (XBOW full technical disclosure) |
| Patch Status: | Server-side fix deployed by Microsoft before advisory publication; no customer action required for Bing. ImageMagick users must harden their own pipelines. |
| Severity: | Critical — CVSS 9.8 for both CVEs; unauthenticated RCE with SYSTEM/root privileges |
| Exploitation Requirements: | No authentication, no cookies, no session state, no user interaction |
References
- Microsoft Security Response Center, “CVE-2026-32194,” Microsoft Update Guide, March 19, 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32194, accessed July 24, 2026.
- Microsoft Security Response Center, “CVE-2026-32191,” Microsoft Update Guide, March 19, 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191, accessed July 24, 2026.
- XBOW, “Bing Images RCEs: How XBOW Found Three Critical Flaws,” XBOW Blog, July 23, 2026, https://xbow.com/blog/bing-images-rce-vulnerabilities, accessed July 24, 2026.
- The Hacker News, “Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers,” July 24, 2026, https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html, accessed July 24, 2026.
- ImageMagick, “Security Policy,” ImageMagick Documentation, https://imagemagick.org/security-policy/, accessed July 24, 2026.
- Red Hat, “ImageTragick,” Red Hat Security, 2016, https://access.redhat.com/security/vulnerabilities/ImageTragick, accessed July 24, 2026.
