Three Critical Microsoft RCE Flaws Exposed in Bing Images and Upload Pipeline

XBOW disclosed three critical Microsoft remote code execution flaws, including two in Bing Images and one in the Microsoft Devices Pricing Program, after reporting them through coordinated vulnerability disclosure. The issues are identified as CVE-2026-32194, CVE-2026-32191, and CVE-2026-21536, and XBOW said Microsoft rated all three CVSS 9.8. According to the disclosure, the two Bing Images bugs were reachable over the network without authentication or user interaction and stemmed from attacker-controlled SVG content being passed into a backend image-processing pipeline where command injection became possible.

XBOW said its research began with a blind SSRF in reverse image search and expanded into parser and renderer testing that pointed to an ImageMagick or ImageMagick-compatible delegate-backed conversion path. The company reported benign out-of-band proof-of-execution from production Bing image-processing workers, including Windows Server 2022 systems running commands as NT AUTHORITY\SYSTEM and Linux workers returning uid=0/gid=0. The third flaw, CVE-2026-21536, reportedly allowed unrestricted upload of server-executable files in the Microsoft Devices Pricing Program, underscoring how image converters, delegates, and upload handlers can become high-impact execution points when exposed to untrusted content.