Security researchers have discovered three critical vulnerabilities in Microsoft’s infrastructure, including two flaws in Bing Images that could have allowed attackers to execute remote code on Microsoft’s servers using a specially crafted image.
The vulnerabilities were discovered by AI-powered security research company XBOW and have now been fixed by Microsoft. All three flaws were rated Critical with a CVSS score of 9.8, indicating the highest level of severity.
The most serious issues affected Bing’s image processing system.
The first vulnerability, CVE-2026-32194, was found in Bing’s Search by Image feature. An attacker could upload a specially crafted SVG image that tricked the backend image processing system into executing operating system commands instead of simply processing the image.
The second flaw, CVE-2026-32191, affected Bing’s reverse image search system. Researchers found that Bing’s crawler could be tricked into fetching a malicious image from an attacker-controlled server, leading to the same type of command execution.
A third vulnerability, CVE-2026-21536, affected Microsoft’s Devices Pricing Program and allowed unrestricted file uploads.
Researchers began investigating Bing’s reverse image search after noticing that Microsoft’s servers were automatically fetching images from external websites. During testing, they found that uploaded SVG files were not just being displayed. Instead, they were being processed by an image conversion tool similar to ImageMagick.
SVG files are XML-based and can include references to external resources. By carefully crafting an SVG image, researchers were able to inject commands that the image processing software executed on the server.
Instead of rendering the image, the backend system treated parts of the SVG file as operating system commands.
The researchers confirmed that the commands were executed with SYSTEM-level privileges on Windows Server 2022 machines running Bing’s image processing infrastructure. They also found Linux-based workers processing images, suggesting the vulnerable pipeline was deployed across multiple server environments.
XBOW responsibly disclosed the vulnerabilities to Microsoft before making them public.
Microsoft has confirmed that all three vulnerabilities have been patched, and there is currently no indication that they were exploited in real-world attacks before the fixes were released.
Interestingly, XBOW says it has become the first autonomous AI security researcher to reach the top 10 of Microsoft’s bug bounty leaderboard.
These vulnerabilities are another reminder that even simple features like image uploads can become security risks when they involve complex backend processing.
As companies continue adding AI, image recognition, and visual search features, uploaded images are no longer just stored. They are analyzed, converted, resized, and processed through multiple services behind the scenes. Every step in that pipeline increases the attack surface.
