Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-24 11:45 UTC
Importiert: 2026-07-30 12:08 UTC
CVSS: 9.8
Quelle-ID: thn_global
uid_hash: 7549b7b943430e477be3d7fd17504c69be6251ada188b836fe0b095be7d78f1d

The Hacker News

Inhalt

A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.

XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-32194	CRITICAL	9.8	CRITICAL	9.8			2026-03-19

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste