Critical Bing Images RCE Vulnerability CVE-2023-28303 Exposes Microsoft Servers

Key Takeaways

• Three critical remote code execution (RCE) vulnerabilities were discovered in Microsoft’s infrastructure.
• Two of these flaws, CVE-2026-32194 and CVE-2026-32191, allowed attackers to hijack Bing Images backend servers.
• The vulnerabilities enabled full SYSTEM-level access on production Bing servers through specially crafted SVG files.
• All three vulnerabilities received a critical CVSS score of 9.8.
• Microsoft has already patched these issues, remediating the risk to its cloud services.

Critical RCE Flaws Exposed Microsoft Bing Image Servers

Microsoft’s backend infrastructure was recently found to harbor three critical remote code execution (RCE) vulnerabilities, two of which directly targeted Bing Images. These flaws could have allowed attackers to compromise image-processing servers by simply uploading a malicious SVG file. The findings, responsibly disclosed by XBOW researchers and subsequently patched by Microsoft, highlight how seemingly innocuous image-handling functions can become pathways to full system-level compromise on critical production servers.

Vulnerability Details and Severity

Microsoft has officially categorized all three vulnerabilities as Critical, each boasting a maximum CVSS score of 9.8. The first, CVE-2026-32194, is a command injection vulnerability embedded within Bing’s image-processing pipeline. This flaw was exploitable through the publicly accessible “Search by Image” upload feature.

A related vulnerability, CVE-2026-32191, affected a separate server-side image ingestion path linked to Bing’s reverse image search crawler. The third, distinct flaw, CVE-2026-21536, involved an unrestricted file upload vulnerability discovered in the Microsoft Devices Pricing Program.

The credit for discovering these vulnerabilities goes to XBOW, an autonomous AI security researcher. Notably, XBOW has achieved a top 10 ranking on Microsoft’s bug bounty leaderboard, marking it as the first AI to reach such a position.

The Discovery Process: From SSRF to RCE

The investigation that uncovered these critical flaws began somewhat serendipitously. Researchers initially observed that Bing’s reverse image search could be manipulated into fetching an attacker-controlled URL from its backend. This behavior, a classic server-side request forgery (SSRF) pattern, initially appeared to have a low security impact.

Confirmation of this fetch mechanism came from observing outbound requests originating from Bing infrastructure, identifiable by a “bingbot/2.0” user agent. Subsequent analysis revealed inconsistent HTTP 500 errors, which suggested that the backend was engaged in more complex operations than merely retrieving an image. This anomaly prompted researchers to explore whether the fetched content was being parsed by a vulnerable component rather than simply being displayed.

Systematic probing ruled out XML External Entity (XXE) attacks, instead pointing toward an ImageMagick-style rendering engine processing SVG files. This engine utilized “coders” and “delegates” for its operations. Given SVG’s XML-based nature, it can embed references to external resources or execute pseudo-protocols like `label:`, `xc:`, and pipe-based commands. While useful for trusted inputs, these features become highly dangerous when exposed to public uploads.

The successful exploit involved embedding a pipe-prefixed shell command within an SVG reference. This caused the backend’s image conversion library to execute the command as an operating system command instead of rendering it as an image. Attackers could deliver this malicious SVG either directly through Bing’s image upload endpoint or by hosting it externally and having it pulled in via the crawler-based SSRF path, demonstrating two distinct attack vectors leading to the same vulnerable pipeline.

Proof of successful exploitation was obtained through out-of-band callbacks, as the frontend typically returned generic errors while the backend silently executed the commands. Command output confirmed execution under the “NT AUTHORITYSYSTEM” context on Bing image-processing workers running Windows Server 2022 Datacenter. These results were consistently reproducible across multiple hosts and network ranges, indicating a widespread exposure within Bing’s image-processing tier rather than an isolated misconfiguration.

XBOW researchers also discovered Linux-based workers were vulnerable. Initially, these were missed because their automated validation tool was configured only to recognize Linux-specific output like `uid=0(user) gid=0(group)`. After retooling to include Windows proof commands such as `whoami /all` and `systeminfo`, the Linux systems were also confirmed as exploitable.

This type of command injection through image converters is not new, having been seen in past incidents like ImageTragick and similar ExifTool-based RCEs. The significance of this case lies in how applications often treat image parsers as benign “plumbing,” overlooking the decades of format compatibility and shell-out behaviors that can be weaponized by attackers.

What You Should Do

Organizations that operate similar image-processing pipelines should adopt robust security measures to mitigate such risks:

• Disable Risky Delegates: Turn off shell-invoking delegates and pipe-based delegate behaviors in ImageMagick-style converters.
• Enforce Restrictive Policies: Implement strict `policy.xml` and `delegates.xml` configurations, explicitly disallowing high-risk formats such as SVG, MVG, and EPS unless absolutely essential for business operations.
• Implement Egress Controls: Apply stringent egress controls, including destination allowlists and internal-address blocking, for any feature capable of fetching user-supplied URLs.
• Utilize Sandboxing: Run all image conversion processes within sandboxed environments with reduced privileges and strictly constrained outbound network access.
• Diverse Validation: Develop validation harnesses that account for heterogeneous server fleets (both Linux and Windows) to ensure no exploitation signals are missed.

Microsoft has fully addressed both Bing Images vulnerabilities within its cloud service. However, the broader lesson for the cybersecurity community remains: any application that accepts image uploads or fetches external image URLs must treat its conversion pipeline as untrusted, security-critical code, rather than assuming it’s harmless media handling.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.