Bing SVG RCE Vulnerabilities Expose Microsoft Servers
Image search is one of the most mundane features of any major internet service, which is precisely why it is rarely scrutinized for security as rigorously as login forms or payment systems. This oversight proved costly, as vulnerability researchers from XBOW managed to submit a seemingly ordinary file to Bing and successfully seized absolute control over a Microsoft server with system administrator privileges.
Critical Flaws in the Image Processing Pipeline
The experts at XBOW discovered two critical flaws within Bing’s image processing infrastructure. Utilizing a specially crafted SVG file, they executed arbitrary commands on production servers: achieving NT AUTHORITY\SYSTEM access on Windows machines and root access on adjacent Linux machines within the same network. Rigorous testing across disparate servers and network ranges revealed that this vulnerability afflicted Bing’s entire image processing pipeline, rather than an isolated, malfunctioning machine.
The Malicious SVG Exploit Mechanism
The root cause did not lie within the image pixels themselves, but rather within the SVG format which fundamentally consists of XML markup and can harbor references to external files. The conversion program, to which Bing delegated unsupported formats, invoked an external auxiliary utility via the command shell. An image reference commencing with a vertical pipe character (“|”) was interpreted not as a filename, but as a command slated for execution. Thus, a mere single-pixel SVG file compelled the server to execute a command and covertly transmit the output back to the attackers’ server.
The exploit successfully compromised two distinct pathways within this singular processing mechanism. The first avenue involved a standard image upload via the reverse image search function, where the malicious file was transmitted in an encoded format. The second entailed a search via image URL: an attacker merely needed to host the file anywhere on the internet and provide its address, prompting Bing’s web crawler to autonomously download and process it. Neither method necessitated authentication, cookie manipulation, or any interaction from a victim.
Silent Patches and High-Severity CVSS Scores
Microsoft assigned these vulnerabilities the identifiers CVE-2026-32194 and CVE-2026-32191, endowing them with a near-maximum severity score of 9.8 on the CVSS scale. The corporation silently eradicated both issues on the server side in March, preceding any official announcements; consequently, Bing users are not required to take any remedial action.
No evidence suggests that malicious actors exploited these vulnerabilities or publicly disclosed them prior to the patch. XBOW subsequently published the intricate details of the attack mechanism on July 23, having patiently waited for Microsoft to completely seal both breaches.
Industry Implications and Best Practices
This class of error is hardly novel; a remarkably similar flaw was unearthed in the ImageMagick utility back in 2016. The issue periodically resurfaces because website administrators frequently fail to recognize auxiliary image processing utilities as integral components of their risk perimeter.
Developers utilizing diverse tools for processing user-uploaded files are strongly advised to outright prohibit access to external auxiliary programs within their security policy configurations. Furthermore, they should restrict the repertoire of accepted formats primarily discarding SVG and other formats harboring embedded references or interpreters. It is also imperative to audit and disable unused modules, execute image conversion within a strictly isolated, least-privilege environment, and block the processing server from accessing the internet directly.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
