🔴 Critical | Source: The Hacker News
A maliciously crafted SVG file uploaded to Bing Image Search triggered remote code execution on Microsoft’s production image-processing infrastructure, granting attackers SYSTEM-level privileges on Windows workers and root on Linux machines in the same fleet. The vulnerability affected multiple hosts across different network ranges, confirming it was a systemic flaw in Bing’s image-processing tier rather than an isolated misconfiguration. Microsoft has assigned two critical CVEs — CVE-2026-32194 — underscoring the severity of the exposure.
Security Architect’s Take: Review any internal or third-party image-processing pipelines that parse SVG files, and ensure they run in isolated, least-privilege sandboxes with no access to production infrastructure — SVG parsing is a well-known attack surface for SSRF and RCE. If your organisation uses Bing Image APIs or similar cloud-hosted image services, monitor Microsoft’s patch guidance and apply updates immediately once available.
Original advisory: Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers