Command Injection Vulnerabilities in Bing Images Processing Pipeline (CVE-2026-32194, CVE-2026-32191, CVE-2026-21536) — RCE as NT AUTHORITY\SYSTEM

Command Injection Vulnerabilities in Bing Images Processing (TL-2026-1677), also tracked as Bing Images SVG RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-24. It has no confirmed attribution, affects Microsoft Bing Images, references 3 CVEs (CVE-2026-32194, CVE-2026-32191, CVE-2026-21536), maps to 13 MITRE ATT&CK techniques (T1027, T1033, T1041), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1677

Threat ID
TL-2026-1677
Also known as
Bing Images SVG RCE, XBOW Bing Images RCE chain
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
RESOLVED
Category
VULNERABILITY
First published
2026-07-24
Last reviewed
2026-07-24
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloud services
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in Command Injection Vulnerabilities in Bing Images Processing

Malware and tooling: XBOW

Autonomous AI penetration-testing system XBOW discovered two critical OS command-injection flaws (CVE-2026-32194, CVE-2026-32191) in Microsoft Bing Images' server-side image-processing pipeline and a critical unrestricted-file-upload flaw (CVE-2026-21536) in the Microsoft Devices Pricing Program. A crafted SVG file abusing the ImageMagick-style rendering engine's SVG/MVG coder-and-delegate chain achieved arbitrary command execution as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter image-processing workers, and as root on Linux hosts in the same fleet.

How Command Injection Vulnerabilities in Bing Images Processing works

XBOW, an autonomous AI security researcher that has reached the top 10 of Microsoft's bug-bounty leaderboard, identified three critical (CVSS 9.8) remote-code-execution vulnerabilities affecting Microsoft cloud services. The first two, CVE-2026-32194 and CVE-2026-32191, are OS command-injection flaws (CWE-77 / CWE-78) in Bing Images' server-side image-processing pipeline. XBOW's attack chain began by abusing Bing's reverse-image-search / "Search by Image" crawler functionality: submitting an externally hosted image URL caused Bing's backend to fetch it server-side (a classic SSRF primitive), confirmed by observing outbound requests carrying a "bingbot/2.0" user agent. Triggering HTTP 500 errors on malformed inputs revealed that the backend was doing more than simple image retrieval — it was passing fetched images through a full ImageMagick-style rendering pipeline that dispatches by file type to internal "coders and delegates." Because SVG is XML-based and ImageMagick's SVG decoder translates SVG markup into its own Magick Vector Graphics (MVG) command language, XBOW crafted an SVG file containing a pipe-prefixed shell command smuggled through an MVG-reachable attribute (the same ImageTragick-class primitive documented in CVE-2026-56379, where XML-encoded carriage returns turn attributes like <polyline points="..."> into injectable MVG lines, e.g. via url()/label:/pipe pseudo-protocols). When Bing's pipeline rendered the SVG, the injected MVG directive was passed to a shell rather than treated as drawing data, yielding arbitrary OS command execution on the processing worker. Two delivery paths worked: direct submission through Bing's public image-upload/search-by-image endpoint, and external hosting combined with the crawler-driven SSRF fetch. Exploitation was confirmed as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter hosts (verified via commands such as whoami /all and systeminfo) and as root on Linux hosts in the same processing fleet — XBOW's automated validators initially missed the Linux hosts because they were tuned only to recognize Linux-style command output until retooled to also validate Windows command output, indicating the vulnerable pipeline spanned a heterogeneous, multi-host fleet rather than a single machine. The third vulnerability, CVE-2026-21536 (CWE-434, unrestricted upload of a file with dangerous type), affected the Microsoft Devices Pricing Program and allowed an unauthenticated attacker to upload and have executed an arbitrary/dangerous file type, again yielding critical remote code execution with no authentication or user interaction required. All three CVEs were credited to XBOW and disclosed responsibly to Microsoft; CVE-2026-21536 was addressed in the March 2026 Patch Tuesday cycle (published March 5-6, 2026) and CVE-2026-32194/CVE-2026-32191 were published March 19-20, 2026, with fixes rolled into a later cumulative update (KB5089549, May 12, 2026, for Windows 11 24H2/25H2) alongside an unrelated critical Azure Cloud Shell SSRF privilege-escalation flaw (CVE-2026-32169, CVSS 10.0) patched in the same cycle. Microsoft has confirmed the Bing Images service-side vulnerabilities are fully remediated in its cloud service; because the flaws lived in Microsoft's hosted backend rather than in client software, no separate customer-side patch was required for the Bing Images issues themselves. The case is notable as one of the first instances of a fully autonomous AI pentesting system independently discovering and validating multi-stage RCE chains (SSRF-to-image-processing-to-command-injection) against live, production hyperscaler infrastructure.

MITRE ATT&CK techniques used in TL-2026-1677

Defense Evasion

T1027 Obfuscated Files or Information

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

persistence

T1505 Server Software Component

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in Command Injection Vulnerabilities in Bing Images Processing

  • Microsoft — Bing Images
    Vulnerable versions: all versions prior to fix (server-side cloud service)
    Fixed in: patched cloud-side by Microsoft; client update KB5089549 for related Windows 11 24H2/25H2 fixes
  • Microsoft — Windows Server 2022 Datacenter (Bing image-processing workers)
    Vulnerable versions: fleet hosts prior to server-side remediation
    Fixed in: remediated by Microsoft
  • Microsoft — Microsoft Devices Pricing Program
    Vulnerable versions: prior to March 2026 Patch Tuesday fix
    Fixed in: patched March 2026
  • Microsoft — Windows 11
    Vulnerable versions: 24H2 build < 26100.8457; 25H2 build < 26200.8457
    Fixed in: 24H2 build 26100.8457; 25H2 build 26200.8457 (KB5089549)

Remediation for Command Injection Vulnerabilities in Bing Images Processing

Patches

  • KB5089549 (Windows 11 24H2/25H2) — addresses CVE-2026-32194, CVE-2026-32191, and unrelated CVE-2026-32169 (Azure Cloud Shell)
  • Microsoft server-side fix for Bing Images image-processing pipeline (cloud-service-side, no customer package)
  • March 2026 Patch Tuesday fix for CVE-2026-21536 (Microsoft Devices Pricing Program)

Immediate actions

  • Verify Bing Images / Microsoft cloud service patch status is current (Microsoft has stated full remediation server-side; no customer action required for Bing Images itself)
  • Apply Windows security update KB5089549 (Windows 11 24H2/25H2, build 26100.8457 / 26200.8457) or later cumulative updates addressing CVE-2026-32194 and CVE-2026-32191
  • Apply patches addressing CVE-2026-21536 in any self-hosted Microsoft Devices Pricing Program-related components
  • Audit any internet-facing image-upload or reverse-image-search functionality for SSRF-to-render pipeline exposure

Workarounds

  • Restrict or disable SVG upload/processing on any public-facing image search or upload feature pending patch verification
  • Strip or reject SVG files containing external resource references, url()/label:/pipe pseudo-protocols, or non-standard MVG-reachable attributes at the ingress layer
  • Rate-limit and monitor outbound requests originating from image-processing/crawler workers for anomalous destinations (SSRF indicator)

Longer-term hardening

  • Disable shell-invoking ImageMagick coders/delegates (ephemeral/EPHEMERAL, MSL, URL, HTTPS, MVG label:/pipe pseudo-protocols) via policy.xml <policy domain="coder" rights="none" pattern="..."/> entries
  • Sandbox all server-side image conversion/rendering processes (seccomp, containers with no outbound network, no shell access) so a rendering-engine compromise cannot reach the host OS
  • Enforce strict egress controls / deny-by-default outbound networking from image-processing workers to prevent SSRF pivoting into internal fetches
  • Build detection/validation harnesses that account for heterogeneous OS fleets (Windows and Linux) so anomalous command execution isn't missed due to OS-specific validator assumptions
  • Treat any XML-based upload format (SVG, and similarly-processed vector/markup formats) as untrusted code, not passive data, when routed through legacy rasterization engines

CVEs associated with Command Injection Vulnerabilities in Bing Images Processing

CVE-2026-32194, CVE-2026-32191, CVE-2026-21536

Weaknesses (CWE) in Command Injection Vulnerabilities in Bing Images Processing

CWE-77, CWE-78, CWE-434, CWE-116, CWE-918

Timeline of Command Injection Vulnerabilities in Bing Images Processing

  • CVE-2026-21536 (Microsoft Devices Pricing Program unrestricted file upload / RCE) published to NVD; credited to XBOW, addressed in Microsoft's March 2026 Patch Tuesday cycle
  • Microsoft's March 2026 Patch Tuesday release ships the fix for CVE-2026-21536, one of the most severe issues in that release
  • CVE-2026-32194 (Bing Images command injection, CWE-77) published to NVD, credited to XBOW
  • CVE-2026-32191 (Bing Images OS command injection, CWE-78) published, credited to XBOW
  • Microsoft ships Windows 11 cumulative update KB5089549 (builds 26100.8457 / 26200.8457) formally rolling in fixes referencing CVE-2026-32194 and CVE-2026-32191 alongside 97 other security fixes, including the unrelated critical Azure Cloud Shell SSRF flaw CVE-2026-32169
  • CVE-2026-32194 NVD record last modified/analyzed
  • TL-Intel HUNT phase identifies the disclosure via CybersecurityNews RSS feed and opens threat TL-2026-1677
  • XBOW publishes a public writeup detailing the full exploit chain across all three vulnerabilities; cybersecurity trade press (CybersecurityNews, GuardianMSSP, TheHackerWire) covers the disclosure, confirming Microsoft has fully remediated the Bing Images vulnerabilities in its cloud service

Sources cited for Command Injection Vulnerabilities in Bing Images Processing

Threats related to Command Injection Vulnerabilities in Bing Images Processing

Detection coverage for TL-2026-1677

As of 2026-07-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1677 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats