Bing’s Image Tier Became Server-Side Code Execution
Bing’s image pipeline was treating attacker-controlled SVG as a command source, so a file that should have been inert could run code as the worker account. The important break is not the client-facing search feature. It is the backend conversion tier that turned image handling into privileged execution on Windows and Linux workers.
Microsoft fixed two server-side flaws, CVE-2026-32194 and CVE-2026-32191, after XBOW showed crafted SVGs running as NT AUTHORITY\SYSTEM on Windows and root on Linux across production image-processing workers. The exploit mechanics were published later, after private remediation had landed, and Microsoft said there was no customer action to resolve.
The same trust break can repeat anywhere uploads or fetched images pass through delegate-enabled converters. Image pipelines are often left out of attack-surface inventories, so parser bugs there can quietly become server compromise instead of a simple browser-side issue.