Microsoft has patched three critical remote code execution flaws, two of them in Bing Images, that allowed anyone on the internet to run commands on production Microsoft servers by uploading a picture.
Security firm XBOW disclosed the details this week after Microsoft completed remediation. All three carry CVSS scores of 9.8 and required no authentication, no cookies, and no user interaction.
- CVE-2026-32194 is a command injection in the Bing Images processing pipeline reachable through the public "Search by Image" upload.
- CVE-2026-32191 covers the same weakness, reached a different way, through Bing's own crawler fetching an attacker-hosted file.
- CVE-2026-21536 is an unrestricted upload flaw in the Microsoft Devices Pricing Program.
The findings came from XBOW's autonomous system rather than a human researcher, landing the company in the top 10 of Microsoft's bug bounty leaderboard — the first AI to appear there.
The entry point was unremarkable: a blind SSRF (server-side request forgery, where a backend can be tricked into fetching a URL) and an inconsistent HTTP 500 error. Chasing that error revealed that fetched content was being handed to an ImageMagick-style conversion tier with dangerous delegates still enabled.
That turns a picture into a shell. SVG files are XML, not pixels, and an embedded xlink:href beginning with a pipe character gets passed straight to a command interpreter. XBOW's proof-of-concept was three lines long. Callbacks came back showing uid=0 on Linux workers and NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter machines — full administrative control, reproduced across multiple hosts and network ranges rather than a single misconfigured box.
None of this is new. ImageTragick (CVE-2016-3714) documented the same class a decade ago. "Applications treat image helpers as plumbing," XBOW wrote. "Attackers treat them as parsers."
That is the part worth acting on. Any service accepting user-supplied images likely runs the same components. Administrators should enforce a restrictive policy.xml and delegates.xml, disable shell-invoking and pipe-based delegates, block SVG, MVG, and EPS unless explicitly needed, run conversion in a low-privilege sandbox, and restrict outbound network access from processing workers.
Bing users need to do nothing — the fixes are already live.