Back Feeds.4Sysops

Critical remote code execution flaws patched in Microsoft Bing image processing

Feeds.4Sysops •IT News • July 24, 2026

Microsoft recently addressed two critical remote code execution vulnerabilities, CVE-2026-32194 and CVE-2026-32191, discovered within the Bing image- service. These flaws allowed attackers to execute arbitrary commands with SYSTEM privileges on Windows Server 2022 Datacenter nodes or root access on Linux backend workers. The vulnerabilities were identified by the security firm XBOW, which demonstrated that malicious SVG files could trigger command injection during server-side image parsing. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerabilities in Microsoft Bing Image Processing Patched Microsoft has patched two critical remote code execution vulnerabilities, CVE-2026-32194 and CVE-2026-32191, in its Bing image processing service. Discovered by XBOW, these flaws allowed attackers to execute arbitrary commands with SYSTEM privileges on Windows Server 2022 Datacenter and root access on Linux systems. The vulnerabilities were triggered by maliciously crafted SVG files during server-side image parsing. Microsoft released patches to mitigate these vulnerabilities on July 24, 2026. Organizations using affected systems are urged to apply the updates immediately to prevent potential exploitation. 4 sources 71

Extracted Entities

Critical remote code execution flaws patched in Microsoft Bing image processing

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)