Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and

The article reports that crafted SVG files sent to Bing Images could trigger command injection in Microsoft's server-side image-processing pipeline, achieving remote code execution as NT AUTHORITY\SYSTEM on Windows workers and root on Linux across the fleet before Microsoft patched CVE-2026-32194 and CVE-2026-32191.[1][2][3] These flaws were reachable over the network without authentication or user interaction and arose from untrusted SVG content being passed into delegate-enabled image conversion components that treated parts of the image as executable commands.[1][2][4] From a RealGround perspective, this illustrates a critical AI supply chain risk: auxiliary services like image parsers, converters, and crawling pipelines used around search and AI experiences can become high-impact execution points if not sandboxed, privilege-reduced, and tightly configured. Organizations should apply SBOM-driven dependency review, hardened policies for media-processing libraries, and continuous red teaming of server-side ingestion workflows to prevent similar command injection and RCE paths in their own AI and search infrastructures.[1][2]