Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers

Cybersecuritynews •Guru Baran • July 24, 2026

Three critical remote code execution (RCE) vulnerabilities in Microsoft’s infrastructure, with two flaws in Bing Images allowing attackers to hijack backend image-processing servers using nothing more than a crafted SVG file. The findings, disclosed responsibly by XBOW and now patched, expose how an “ordinary” image-handling feature became a gateway to full SYSTEM-level access on production […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities in Microsoft Bing Image Processing Patched Microsoft has patched two critical remote code execution vulnerabilities, CVE-2026-32194 and CVE-2026-32191, in its Bing image processing service. Discovered by XBOW, these flaws allowed attackers to execute arbitrary commands with SYSTEM privileges on Windows Server 2022 Datacenter and root access on Linux systems. The vulnerabilities were triggered by maliciously crafted SVG files during server-side image parsing. Microsoft released patches to mitigate these vulnerabilities on July 24, 2026. Organizations using affected systems are urged to apply the updates immediately to prevent potential exploitation. 4 sources 71

Extracted Entities

Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers

The full story

Extracted Entities

Companies (1)

Platforms (1)

Tools (1)