"The application believed it was handling an image; the helper underneath read part of that image as a command."
XBOW's discovery and the immediate fallout
Autonomous offensive-security startup XBOW privately reported two critical server-side flaws in Bing's image-processing pipeline that allowed a crafted SVG to execute arbitrary commands on production workers. The exploit ran as NT AUTHORITY\SYSTEM on Windows image workers and as root on Linux hosts; XBOW's testing reproduced the behavior across different hosts and network ranges, indicating a problem in Bing's image tier rather than a single compromised machine.
Microsoft issued two critical CVEs on March 19 — CVE-2026-32194 and CVE-2026-32191 — each rated 9.8 on the CVSS scale. Microsoft fixed the flaws server-side before publishing the advisories and recorded that there was "no customer action to resolve." Neither advisory listed exploitation in the wild or prior public disclosure at the time they went up; XBOW held back publishing exploit mechanics at Microsoft's request and released them on July 23.
How the SVG turned into a shell: delegates, pipes and blind fetches
The trigger point was not pixels but XML. SVG files can reference other resources, and renderers that follow those references will fetch them. In Bing's pipeline, conversion suites handed formats they did not process themselves to a delegate program invoked through a shell. In the path XBOW reached, that delegate layer was enabled and treated an image reference beginning with a pipe character as a shell command rather than a filename.
XBOW's payload was a one-pixel SVG whose reference began with a pipe; when the worker fetched and parsed that SVG it invoked the delegate via the shell, executed a command, and then curled the output back to a collector controlled by XBOW. The frontend could return an error (some workers returned HTTP 500) while the worker fetched and parsed the resource anyway — a blind SSRF turned into remote command execution by the parser behind the worker.
CVE paths: upload and crawler routes
The two public CVEs map to distinct entry routes into the same conversion tier. CVE-2026-32194 (command injection, CWE-77) corresponds to the "Search by Image" upload where the SVG is submitted base64 in the imageBin field to /images/kblob. CVE-2026-32191 (OS command injection, CWE-78) is the crawler path: hosting the malicious SVG and passing its URL through the imgurl parameter, which bingbot/2.0 fetched into the same pipeline. Neither route required authentication, cookies, session state, or a user click.
On Linux workers XBOW observed uid=0 and gid=0; on Windows, systeminfo identified Windows Server 2022 Datacenter, whoami /all showed SeImpersonatePrivilege and SeDebugPrivilege enabled, and directory listings placed execution inside Bing's multimedia image-processing components. XBOW says it executed only benign read-only commands and did not touch customer data.
ImageMagick delegates and the recommended hardening steps
The underlying conversion tool in question behaves like many ImageMagick-compatible stacks: by default its delegate policy is permissive and intended for sandboxed or firewalled use. ImageMagick's explicit guidance for handling untrusted images is to deny delegates outright in policy.xml, for example:
<policy domain="delegate" rights="none" pattern="*" />
Beyond denying delegates, the source lists prioritized mitigations XBOW and ImageMagick recommend: cut the formats you accept (SVG, MVG, EPS are notable risks), review and disable unnecessary entries in delegates.xml, run conversion tasks sandboxed and with reduced privileges, block outbound network access from the worker, allowlist server-side fetch destinations, and keep the worker off internal addresses. ImageMagick provides magick identify -list policy to verify the active policy.
XBOW also observed that different ImageMagick pseudo‑protocols returned varying behavior during probing; only the image reference inside SVG reached the vulnerable delegate path. The report ties this class of failure to ImageTragick (CVE-2016-3714), noting the same attack surface resurfaces because converters are often treated as plumbing while attackers treat them as parsers — a point XBOW CISO Nico Waisman summarized: "Applications treat image helpers as plumbing. Attackers treat them as parsers."
What this means for technologists, enterprises and end users
- Technologists and security teams: If your stack pipes uploads or server-fetched URLs through ImageMagick or any compatible converter, your exposure depends on whether attacker-controlled content can reach a delegate-enabled path. The practical steps are to deny delegates, restrict accepted formats, and block outbound network access from workers.
- Affected enterprises and procurement leaders: Microsoft states there is "no customer action to resolve" for these particular advisories because the fixes were applied server-side. Still, organizations that host server-side image conversion should assume they need configuration and environment changes to prevent similar delegate-based command injection in their own infrastructure.
- End users and the public: Neither CVE record showed exploitation at publication, and XBOW reports it executed only benign commands and did not access customer data. However, the flaw required no authentication and could be triggered by a simple upload or URL — a reminder that invisible server-side processing can produce high-severity outcomes.
The quick patching by Microsoft closed the immediate window of exposure, but the lesson persists: a renderer that "believes" it handles an image can be forced to run a shell if a conversion delegate, outbound fetch, and permissive policy line up. Fixing the servers is one thing; counting the converter as part of your attack surface is the lasting work.
