Bing Images: two SVG traps, and ImageMagick executes SYSTEM code on Microsoft servers

CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.

The facts

On July 23, 2026, the startup XBOW - an autonomous offensive security platform that discovers vulnerabilities at scale with offensive AI agents - published the exploitation mechanics of two critical vulnerabilities in Bing Images, Microsoft's reverse image search infrastructure:

• CVE-2026-32194 - Command Injection (CWE-77), CVSS 9.8.
• CVE-2026-32191 - OS Command Injection (CWE-78), CVSS 9.8.

Affected component: the backend workers of ImageMagick that process images submitted via reverse image search on Bing. Microsoft patched server-side on March 19, 2026, without requiring any client action.

Analysis - how an SVG lights up a remote shell

The vulnerability relies on ImageMagick delegates, this historical mechanism that allows the library to delegate certain formats to external programs (ghostscript for PDF, ffmpeg for video, curl for remote URLs). The dangerous behavior: when ImageMagick encounters a file reference starting with the pipe (|) character, it interprets it as a shell command to execute, not as a file path.

The XBOW vector is an SVG file where an image attribute (for example xlink:href on an <image>) starts with |. Sent to Bing for reverse search, this SVG goes through the ImageMagick server-side grinder - which complies and executes the command. The XBOW demonstration made an outgoing curl to an infrastructure controlled by the attacker: proof of exfiltration from Bing workers with the SYSTEM privileges of the process.

For the record, ImageMagick is the direct lineage of the ImageTragick class (2016, CVE-2016-3714) which exploited the same delegate mechanism - ten years later, the surface remains sensitive in pipelines that blindly trust uploaded files.

Who is impacted

• Microsoft directly: the Bing Image Search workers - patch applied server-side in March 2026.
• End users: no action required. No customer data has been identified as exfiltrated, and Microsoft advisories indicate "exploitation not detected" at their release.
• Any SaaS platform processing user uploads with ImageMagick without a restrictive policy.xml configuration: the XBOW vulnerability reminds us that the delegate mechanism remains dangerous ten years after ImageTragick. If your pipeline receives user images and passes them through IM/GraphicsMagick, now is the time to check.

What to do now

1. Audit your /etc/ImageMagick-6/policy.xml (or 7): explicitly block sensitive coders (MSL, MVG, URL, HTTPS, HTTP, FTP, EPHEMERAL, TEXT, SHOW, WIN, PLT) with <policy domain="coder" rights="none" pattern="…" />.
2. Refuse or systematically clean up SVG uploads application-side before any server-side processing - an SVG is XML, it can carry much more than an image.
3. Isolate ImageMagick workers in a sandbox (namespace, seccomp, non-privileged container).
4. If you consume Bing Image Search via API: no action, Microsoft has patched server-side.

Analysis - the XBOW signal

XBOW is a young company that sells an autonomous offensive security service: their AI agents continuously scan the attack surface of clients (and public targets like Bing) and provide vulnerability reports. Finding two CVE 9.8 on Bing's infrastructure with a four-month embargo to let Microsoft patch is a great business card - and a signal that AI-first offensive tools are starting to generate CVEs at a different pace than traditional red teams.