# Command Injection Vulnerabilities in Bing Images Processing Pipeline (CVE-2026-32194, CVE-2026-32191, CVE-2026-21536) — RCE as NT AUTHORITY\SYSTEM

> Autonomous AI penetration-testing system XBOW discovered two critical OS command-injection flaws (CVE-2026-32194, CVE-2026-32191) in Microsoft Bing Images' server-side image-processing pipeline and a critical unrestricted-file-upload flaw (CVE-2026-21536) in the Microsoft Devices Pricing Program. A crafted SVG file abusing the ImageMagick-style rendering engine's SVG/MVG coder-and-delegate chain achieved arbitrary command execution as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter image-processing workers, and as root on Linux hosts in the same fleet.

- **Published:** 2026-07-24T00:00:00Z
- **Last reviewed:** 2026-07-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1677
- **ID:** TL-2026-1677
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-32194, CVE-2026-32191, CVE-2026-21536

## Description

XBOW, an autonomous AI security researcher that has reached the top 10 of Microsoft's bug-bounty leaderboard, identified three critical (CVSS 9.8) remote-code-execution vulnerabilities affecting Microsoft cloud services. The first two, CVE-2026-32194 and CVE-2026-32191, are OS command-injection flaws (CWE-77 / CWE-78) in Bing Images' server-side image-processing pipeline. XBOW's attack chain began by abusing Bing's reverse-image-search / "Search by Image" crawler functionality: submitting an externally hosted image URL caused Bing's backend to fetch it server-side (a classic SSRF primitive), confirmed by observing outbound requests carrying a "bingbot/2.0" user agent. Triggering HTTP 500 errors on malformed inputs revealed that the backend was doing more than simple image retrieval — it was passing fetched images through a full ImageMagick-style rendering pipeline that dispatches by file type to internal "coders and delegates." Because SVG is XML-based and ImageMagick's SVG decoder translates SVG markup into its own Magick Vector Graphics (MVG) command language, XBOW crafted an SVG file containing a pipe-prefixed shell command smuggled through an MVG-reachable attribute (the same ImageTragick-class primitive documented in CVE-2026-56379, where XML-encoded carriage returns turn attributes like <polyline points="..."> into injectable MVG lines, e.g. via url()/label:/pipe pseudo-protocols). When Bing's pipeline rendered the SVG, the injected MVG directive was passed to a shell rather than treated as drawing data, yielding arbitrary OS command execution on the processing worker. Two delivery paths worked: direct submission through Bing's public image-upload/search-by-image endpoint, and external hosting combined with the crawler-driven SSRF fetch. Exploitation was confirmed as NT AUTHORITY\SYSTEM on Windows Server 2022 Datacenter hosts (verified via commands such as whoami /all and systeminfo) and as root on Linux hosts in the same processing fleet — XBOW's automated validators initially missed the Linux hosts because they were tuned only to recognize Linux-style command output until retooled to also validate Windows command output, indicating the vulnerable pipeline spanned a heterogeneous, multi-host fleet rather than a single machine. The third vulnerability, CVE-2026-21536 (CWE-434, unrestricted upload of a file with dangerous type), affected the Microsoft Devices Pricing Program and allowed an unauthenticated attacker to upload and have executed an arbitrary/dangerous file type, again yielding critical remote code execution with no authentication or user interaction required. All three CVEs were credited to XBOW and disclosed responsibly to Microsoft; CVE-2026-21536 was addressed in the March 2026 Patch Tuesday cycle (published March 5-6, 2026) and CVE-2026-32194/CVE-2026-32191 were published March 19-20, 2026, with fixes rolled into a later cumulative update (KB5089549, May 12, 2026, for Windows 11 24H2/25H2) alongside an unrelated critical Azure Cloud Shell SSRF privilege-escalation flaw (CVE-2026-32169, CVSS 10.0) patched in the same cycle. Microsoft has confirmed the Bing Images service-side vulnerabilities are fully remediated in its cloud service; because the flaws lived in Microsoft's hosted backend rather than in client software, no separate customer-side patch was required for the Bing Images issues themselves. The case is notable as one of the first instances of a fully autonomous AI pentesting system independently discovering and validating multi-stage RCE chains (SSRF-to-image-processing-to-command-injection) against live, production hyperscaler infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1071 Application Layer Protocol
- T1587 Develop Capabilities
- T1595 Active Scanning
- T1199 Trusted Relationship
- T1505 Server Software Component
- T1041 Exfiltration Over C2 Channel
- T1027 Obfuscated Files or Information

## Sources

- [Bing Images Vulnerability Allowed Attackers to Execute Malicious Commands](https://cybersecuritynews.com/bing-images-vulnerability/)
- [XBOW Finds Critical Microsoft RCE Vulnerabilities](https://xbow.com/blog/three-rce-vulnerabilities-in-microsoft-identified-xbow)
- [Bing Images RCEs: How XBOW Found Three Critical Flaws](https://xbow.com/blog/bing-images-rce-vulnerabilities)
- [CVE-2026-32191: Microsoft Bing Images RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-32191/)
- [CVE-2026-21536 (SentinelOne Vulnerability Database)](https://www.sentinelone.com/vulnerability-database/cve-2026-21536/)
- [CVE-2026-32194 (NVD)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32194)
- [CVE-2026-32194 Microsoft Security Response Center Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32194)
- [Windows 11 security update fixes critical Bing and Azure flaws](https://cyberinsider.com/windows-11-security-update-fixes-critical-bing-and-azure-flaws/)
- [Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers](https://www.guardianmssp.com/2026/07/24/bing-images-flaws-let-crafted-svgs-run-commands-as-system-on-microsofts-servers/)
- [Microsoft Devices Pricing Program critical RCE credited by XBOW](https://bugflation.com/findings/cve-2026-21536-microsoft-devices-pricing/)
- [XBOW - Bugflation researcher profile](https://bugflation.com/systems/xbow/)
- [ImageMagick - Command Injection via SVG Decoder](https://www.vulncheck.com/advisories/imagemagick-command-injection-via-svg-decoder)
- [Critical Command Injection in Microsoft Bing Images](https://www.thehackerwire.com/critical-command-injection-in-microsoft-bing-images/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1677