Affected Systems

Microsoft Bing Images service (CVE-2026-32194, CVE-2026-32191). Both Windows Server 2022 and Linux image-processing workers. Vulnerability exploitable via public "Search by Image" upload and URL-based image crawler. No specific product versions listed; server-side infrastructure only.

Exploitation Status

Microsoft patched server-side in March 2026 before public disclosure. No exploitation observed per Microsoft advisories as of July 24, 2026. XBOW published full exploit mechanics July 23, 2026, including proof-of-concept demonstrating command execution as NT AUTHORITY\SYSTEM (Windows) and root (Linux). Exploitation required no authentication.

Business Impact

This was a server-side vulnerability in Microsoft's Bing infrastructure, already remediated by Microsoft with no customer action required. The primary concern for enterprise teams is the attack pattern: crafted SVG files exploiting ImageMagick delegate functionality to achieve command injection. Organizations running ImageMagick or compatible image-processing pipelines that accept untrusted uploads or fetch external URLs face similar risk if delegates remain enabled and input validation is insufficient. CVSS 9.8 (Critical). The vulnerability allowed unauthenticated attackers to execute arbitrary OS commands with maximum privileges on production servers handling image processing.

Urgency

🟡 Within a week

Recommended Actions

  • Audit all internal services using ImageMagick, GraphicsMagick, or compatible libraries that process user-uploaded images or fetch external image URLs.
  • Disable ImageMagick delegates in policy.xml by adding:
  • Restrict accepted image formats to raster-only (JPEG, PNG, GIF, WebP); block SVG, MVG, EPS, and other vector/script-capable formats unless business-critical.
  • Run image-processing workers in sandboxed environments with minimal privileges (not root/SYSTEM), no outbound network access, and allowlisted internal fetch destinations.
  • Verify active ImageMagick policy with 'magick identify -list policy' and review delegates.xml to disable unused coders and delegates.