Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
Two critical CVEs (Cve 2026 32194 Bing Images Svg Windows and Cve 2026 32191 Bing Images Svg Linux, both CVSS 9.8) in Bing's image-processing tier allowed crafted SVGs to achieve Remote Code Execution (RCE) as SYSTEM (Windows) or root (Linux). Discovered by XBOW and fixed server-side by Microsoft.
Overview
| Attribute | Detail |
|---|---|
| Date | 2026-07-24 |
| CVEs | Cve 2026 32194 Bing Images Svg Windows (Windows, CVSS 9.8), Cve 2026 32191 Bing Images Svg Linux (Linux, CVSS 9.8) |
| Type | SVG-triggered Remote Code Execution |
| Discoverer | XBOW |
| Fix | Server-side by Microsoft |
Impact
Crafted SVG images could execute arbitrary commands on Microsoft's production Bing Images servers at the highest privilege level (SYSTEM on Windows, root on Linux). This class of vulnerability underscores the risk of server-side image processing pipelines handling user-supplied SVG content.
Significance
While Microsoft fixed these server-side (no user action required), the vulnerabilities represent a critical finding in a major consumer-facing service. XBOW's discovery methodology — likely involving AI-assisted fuzzing — highlights the growing role of automated vulnerability research.
Related Pages
- Cve 2026 32194 Bing Images Svg Windows — Bing SVG RCE on Windows (SYSTEM, CVSS 9.8)
- Cve 2026 32191 Bing Images Svg Linux — Bing SVG RCE on Linux (root, CVSS 9.8)