**XBOW**'s testing revealed that the vulnerabilities were not isolated to a single machine but were present across different hosts and network ranges within **Bing**'s image processing tier. **Microsoft** has since issued fixes for both server-side vulnerabilities, rating them with a critical CVSS score of 9.8. No user action is required as the patches were applied before public disclosure. ### The Mechanics of the Exploit The core of the vulnerability lay in how **Bing**'s image processing stack handled Scalable Vector Graphics (SVG) files. While the application believed it was processing an image, the underlying helper interpreted a portion of the SVG as a command. **Bing**'s reverse image search functionality, which fetches image URLs from the backend, presented a blind Server-Side Request Forgery (SSRF) opportunity. The crucial clue was that some workers returned a 500 error to the browser while still fetching and parsing the retrieved content, indicating a downstream parsing issue. SVG, being XML-based rather than pixel-based, can reference other images. Image conversion suites often delegate the processing of certain formats to external programs invoked through a shell. In **Bing**'s vulnerable pipeline, this delegation layer was still active. An image reference within the SVG, beginning with a pipe character, was sent to the shell instead of being interpreted as a filename. **XBOW**'s payload was a one-pixel SVG whose reference executed a command on the worker and then curled the output back to a controlled collector.  This led to two distinct routes into the same conversion tier, resulting in two CVEs: * **CVE-2026-32194** (CWE-77: Command Injection): This vulnerability affected the public "Search by Image" upload functionality, where a base64-encoded SVG was submitted via the `imageBin` field to `/images/kblob`. * **CVE-2026-32191** (CWE-78: OS Command Injection): This route exploited the crawler, where an SVG hosted anywhere could be provided via the `imgurl` parameter, and `bingbot/2.0` would fetch it into the vulnerable pipeline. Neither vulnerability required authentication, cookies, session state, or user interaction. **XBOW** confirmed execution on both Linux workers (returning `uid=0` and `gid=0`) and Windows Server 2022 Datacenter machines (showing `SeImpersonatePrivilege` and `SeDebugPrivilege` enabled). **XBOW** states they only ran benign read-only commands and did not access customer data. ### The Importance of Disabling Delegates The core takeaway from this incident is a critical security principle: an image-processing worker handling untrusted files should never be able to reach a shell, run with elevated privileges like `SYSTEM`, or have outbound network access to the internet. **Bing**'s pipeline unfortunately exhibited all three. **ImageMagick**'s own security policy explicitly states that its default configuration is open and intended for sandboxed or firewalled environments, not public-facing websites. For any system processing untrusted images, the guidance is to outright deny delegates in `policy.xml`: Further mitigation steps include: 1. **Restrict Accepted Formats**: Limit the image formats accepted, as SVG, MVG, and EPS are known to carry references and interpreters. 2. **Review `delegates.xml`**: Disable any unnecessary enabled delegates. 3. **Sandbox and Reduce Privileges**: Run conversion processes in a sandboxed environment with minimal privileges. 4. **Block Outbound Network**: Prevent workers from initiating outbound network connections, which would have contained the impact of this blind vulnerability. 5. **Allowlist Destinations**: For server-side fetches, allowlist permissible destinations and ensure workers cannot access internal network addresses. **ImageMagick** also recommends testing thoroughly after any policy changes, using `magick identify -list policy` to verify the loaded configuration. This incident echoes the **ImageTragick** vulnerabilities of 2016 (**CVE-2016-3714**), highlighting a recurring issue where image converters are often overlooked as part of the attack surface. As **XBOW** CISO **Nico Waisman** aptly put it, "Applications treat image helpers as plumbing. Attackers treat them as parsers." The ability to turn a blind SSRF into a `SYSTEM` shell underscores the importance of deep security analysis, especially for components often considered mere utility functions. The critical lesson is that the parser behind the fetch can be the gateway to severe compromise, even when frontend responses give no direct indication of the underlying execution.