Microsoft‘s Bing Images faced not one but two critical remote code execution flaws that allowed hackers to run system-level commands on backend servers. The vulnerabilities—CVE-2026-32194 and CVE-2026-32191—both scored a maximum CVSS of 9.8, requiring no authentication or user privileges to exploit.

The attack worked by uploading a specially crafted SVG image through Bing’s public “Search by Image” feature. The image processing pipeline then handed the file to ImageMagick, an open-source image library with a dangerous default: it automatically delegates certain file types to helper programs, including Ghostscript for PostScript files. A malicious SVG could trick ImageMagick into executing arbitrary shell commands, running as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter.

How the Attack Worked

An attacker didn’t need a Bing account, API key, or session token. They could upload a poisoned image directly through the web interface. The vulnerability lived in two paths: the public-facing “Search by Image” upload (CVE-2026-32194) and Bing’s reverse-image-search crawler route (CVE-2026-32191). Both led to the same backend image processing workers, both exploitable via SVG polyglots—files that are valid SVGs but contain embedded PostScript that triggers code execution.

Researchers at XBOW security lab discovered the flaw and notified Microsoft. The company had already patched the issue on its servers back in March 2026, months before the public disclosure. But for three months after the fix, attackers could have used this to hijack Bing’s image-processing infrastructure.

What This Reveals

ImageMagick’s delegate feature is a well-known footgun in the security world. The library is installed on millions of servers worldwide, often configured to “just work” out of the box—meaning delegate programs are enabled by default. Any application that processes user-uploaded images and passes them to ImageMagick without sandboxing is potentially vulnerable to the same attack class.

This is not an ImageMagick problem alone. It’s a cascade problem: permissive defaults in image libraries, combined with deployment practices that don’t restrict what commands those libraries can invoke, combined with insufficient input validation. Microsoft’s responsibility was to harden the image pipeline. The company did. But thousands of other services running similar setups may not have.

Lessons for Defenders

If your application processes images uploaded by users, assume the file is hostile. Use a sandboxed image processor. Restrict ImageMagick’s delegates. Disable formats you don’t need. Or use a library with secure defaults—something designed to be attacked and hardened, not something designed to be flexible and later secured.

Microsoft fixed this three months ago. But the disclosure matters. Researchers can now test their own systems using the same technique.

FYI (keeping you in the loop)

Did attackers use this vulnerability?

Microsoft has not disclosed evidence of active exploitation. The flaw was fixed before public disclosure. But a three-month window is long enough for Nation states and sophisticated threat actors to have discovered and weaponized it independently.