Recent discoveries have unveiled three critical remote code execution (RCE) vulnerabilities within Microsoft’s infrastructure, notably affecting Bing Images. These flaws enable attackers to gain control over backend image-processing servers by exploiting specially crafted SVG files.
Identified as CVE-2026-32194 and CVE-2026-32191, these vulnerabilities reside in Bing’s image-processing pipeline. CVE-2026-32194 pertains to the “Search by Image” upload feature, where improper neutralization of special elements in OS commands allows unauthorized code execution over a network. Similarly, CVE-2026-32191 affects the reverse image search functionality, enabling attackers to execute arbitrary code by exploiting the server-side image ingestion process.
Both vulnerabilities stem from inadequate sanitization of user-supplied input, leading to command injection scenarios. Attackers can craft malicious SVG files that, when processed by Bing’s image conversion library, execute embedded commands on the server. This is facilitated by the library’s handling of SVG files, which can reference external resources or execute pseudo-protocols, features that become hazardous when exposed to untrusted inputs.
These vulnerabilities were responsibly disclosed by XBOW, an autonomous AI security researcher, and have since been patched by Microsoft. The severity of these flaws is underscored by their maximum CVSS score of 9.8, indicating a critical impact on system confidentiality, integrity, and availability.
In addition to the Bing Images vulnerabilities, a third flaw, CVE-2026-21536, was identified in the Microsoft Devices Pricing Program. This vulnerability involves unrestricted file uploads, allowing attackers to upload executable files without proper validation.
These findings highlight the importance of rigorous input validation and the potential risks associated with processing untrusted data. Organizations must remain vigilant, ensuring that all user inputs are properly sanitized to prevent similar vulnerabilities. The role of AI in identifying such complex security issues also emphasizes the evolving landscape of cybersecurity, where automated systems play a crucial role in threat detection and mitigation.
