{"id":424231,"date":"2026-07-29T08:40:00","date_gmt":"2026-07-29T08:40:00","guid":{"rendered":"https:\/\/dailybanglanewspapers.com\/news\/critical-bing-images-flaws-let-attackers-run-code-on-microsoft-servers\/"},"modified":"2026-07-29T08:40:00","modified_gmt":"2026-07-29T08:40:00","slug":"critical-bing-images-flaws-let-attackers-run-code-on-microsoft-servers","status":"publish","type":"post","link":"https:\/\/dailybanglanewspapers.com\/news\/critical-bing-images-flaws-let-attackers-run-code-on-microsoft-servers\/","title":{"rendered":"Critical Bing Images Flaws Let Attackers Run Code on Microsoft Servers"},"content":{"rendered":"

<\/p>\n

\n

Microsoft<\/a>\u2018s Bing Images faced not one but two critical remote code execution flaws that allowed hackers to run system-level commands on backend servers. The vulnerabilities\u2014CVE-2026-32194 and CVE-2026-32191\u2014both scored a maximum CVSS of 9.8, requiring no authentication or user privileges to exploit.<\/p>\n

\"Bing<\/p>\n

The attack worked by uploading a specially crafted SVG image through Bing\u2019s public \u201cSearch by Image\u201d feature. The image processing pipeline then handed the file to ImageMagick, an open-source image library with a dangerous default: it automatically delegates certain file types to helper programs, including Ghostscript for PostScript files. A malicious SVG could trick ImageMagick into executing arbitrary shell commands, running as NT AUTHORITY\\SYSTEM on Windows Server 2022 Datacenter.<\/p>\n

How the Attack Worked<\/h2>\n

An attacker didn\u2019t need a Bing account, API key, or session token. They could upload a poisoned image directly through the web interface. The vulnerability lived in two paths: the public-facing \u201cSearch by Image\u201d upload (CVE-2026-32194) and Bing\u2019s reverse-image-search crawler route (CVE-2026-32191). Both led to the same backend image processing workers, both exploitable via SVG polyglots\u2014files that are valid SVGs but contain embedded PostScript that triggers code execution.<\/p>\n

Researchers at XBOW security lab discovered the flaw and notified Microsoft. The company had already patched the issue on its servers back in March 2026, months before the public disclosure. But for three months after the fix, attackers could have used this to hijack Bing\u2019s image-processing infrastructure.<\/p>\n

What This Reveals<\/h2>\n

ImageMagick\u2019s delegate feature is a well-known footgun in the security world. The library is installed on millions of servers worldwide, often configured to \u201cjust work\u201d out of the box\u2014meaning delegate programs are enabled by default. Any application that processes user-uploaded images and passes them to ImageMagick without sandboxing is potentially vulnerable to the same attack class.<\/p>\n

This is not an ImageMagick problem alone. It\u2019s a cascade problem: permissive defaults in image libraries, combined with deployment practices that don\u2019t restrict what commands those libraries can invoke, combined with insufficient input validation. Microsoft\u2019s responsibility was to harden the image pipeline. The company did. But thousands of other services running similar setups may not have.<\/p>\n

Lessons for Defenders<\/h2>\n

If your application processes images uploaded by users, assume the file is hostile. Use a sandboxed image processor. Restrict ImageMagick\u2019s delegates. Disable formats you don\u2019t need. Or use a library with secure defaults\u2014something designed to be attacked and hardened, not something designed to be flexible and later secured.<\/p>\n

Microsoft fixed this three months ago. But the disclosure matters. Researchers can now test their own systems using the same technique.<\/p>\n

FYI (keeping you in the loop)<\/h4>\n
\nDid attackers use this vulnerability?<\/summary>\n

Microsoft has not disclosed evidence of active exploitation. The flaw was fixed before public disclosure. But a three-month window is long enough for Nation states and sophisticated threat actors to have discovered and weaponized it independently.<\/p>\n<\/details>\n

References<\/h4>\n

The Hacker News. (2026). Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft\u2019s Servers. Published July 2026.<\/p>\n

CyberSecurityNews. (2026). Bing Images Vulnerability Let Attackers Execute Remote Code on Microsoft Servers Using SVG File. Published July 2026.<\/p>\n

SentinelOne. (2026). CVE-2026-32191: Microsoft Bing Images RCE Vulnerability. Published July 2026.<\/p>\n

\n
\n
\n
\"Zoom<\/p>\n
\n

\nZoom Bangla News<\/p>\n

\ninews.zoombangla.com<\/p>\n<\/div>\n<\/div>\n


\nFollow
\n<\/a><\/div>\n

\n

\nFollow iNews Zoombangla On Google<\/p>\n

\nOpen the Google follow page and tap the checkmark option to receive more updates from iNews Zoombangla in your Google news feed.<\/p>\n


\n\"Follow
\n<\/a><\/div>\n<\/div>\n<\/div>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

Microsoft\u2018s Bing Images faced not one but two critical remote code execution flaws that allowed hackers to run system-level commands on backend servers. The vulnerabilities\u2014CVE-2026-32194 and CVE-2026-32191\u2014both scored a maximum CVSS of 9.8, requiring no authentication or user privileges to exploit. The attack worked by uploading a specially crafted SVG image through Bing\u2019s public \u201cSearch […]<\/p>\n","protected":false},"author":3,"featured_media":424232,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"fifu_image_url":"https:\/\/inews.zoombangla.com\/wp-content\/uploads\/2026\/07\/Bing-Images-RCE-vulnerability-CVE.jpg","fifu_image_alt":"","footnotes":""},"categories":[10],"tags":[],"class_list":["post-424231","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifestyle"],"acf":[],"_links":{"self":[{"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/posts\/424231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/comments?post=424231"}],"version-history":[{"count":0,"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/posts\/424231\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/media\/424232"}],"wp:attachment":[{"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/media?parent=424231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/categories?post=424231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dailybanglanewspapers.com\/news\/wp-json\/wp\/v2\/tags?post=424231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}