Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-19 | 2 | Disclosure2 |
| 2026-03-20 | 1 | Disclosure1 |
| 2026-03-22 | 2 | Disclosure2 |
| 2026-03-23 | 1 | Patch1 |
| 2026-03-24 | 2 | Disclosure2 |
| 2026-07-24 | 4 | Active Exploitation2Disclosure1Patch1 |
| 2026-07-25 | 2 | Active Exploitation1Patch1 |
| 2026-07-30 | 1 | Disclosure1 |
| 2026-08-22 | 1 | Disclosure1 |
And OpenAI's partner XBOW disclosed two nt/authority level RCE vulnerabilities in Bing prod server,(CVE-2026-32194 and CVE-2026-32191) 😂 https://t.co/2losmW9EW5
Post summary
OpenAI’s partner XBOW announced two new RCE vulnerabilities (CVE-2026-32194 and CVE-2026-32191) affecting the Bing production server, providing basic technical details but no PoC, exploit code, patch information, or evidence of active exploitation.
A crafted SVG ran commands as SYSTEM on Bing's production image servers, and as root on the Linux hosts in the same fleet. Two critical CVEs (CVE-2026-32194, CVE-2026-32191), CVSS 9.8 each. XBOW hid a shell command inside the SVG's image reference. Patched server-side in March.
Post summary
CVE-2026-32194 and CVE-2026-32191 were actively exploited via crafted SVG files on Bing’s image servers and Linux hosts, executing commands as SYSTEM/root; vulnerability patches were applied server-side in March.
1/3 A single crafted SVG uploaded to Bing image search ran commands as SYSTEM on Microsoft's own servers. Two OS command injection bugs (CVE-2026-32194, CVE-2026-32191) let an image reach a shell with full privileges. Microsoft has patched. #CyberSecurity #InfoSec #CVE https://t.co/6dTWAnmxN4
Post summary
Microsoft’s Bing image search was exploited via OS command injection using a crafted SVG that executed SYSTEM commands, prompting a patch from Microsoft.
🚨 Two critical RCE flaws (CVSS 9.8), CVE-2026-32194 & CVE-2026-32191, in Bing Images let attackers hijack backend servers using just a crafted SVG file — achieving SYSTEM-level access via command injection in the image-processing pipeline. Discovered by AI security researcher XBOW (now top 10 on MS's bug bounty leaderboard 👀). Already patched by Microsoft.
Post summary
Microsoft has patched two critical RCE vulnerabilities (CVE-2026-32194 & CVE-2026-32191) in Bing Images that allowed system‑level command injection through crafted SVG files.
Critical vulnerabilities in Bing Images, identified as CVE-2026-32194 and CVE-2026-32191, allow remote code execution via crafted SVG files. These flaws, now patched, underscore the importance of robust input validation in image-processing pipelines to prevent command injection attacks. #Security #BingImages #RCE #Cybersecurity #Microsoft #Vulnerabilities https://thedailytechfeed.com/critical-vulnerabilities-in-bing-images-allow-remote-code-execution/
Post summary
The post announces two new CVEs (2026‑32194, 2026‑32191) in Bing Images that allow remote code execution via crafted SVG files and notes that patches are now available.
#securityupdate #microsoft #定例外 2026. 3.19 Microsoft Bing Images Remote Code Execution Vulnerability CVE-2026-32191 Security Vulnerability リリース日: - マイクロソフト https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191
Post summary
The post announces Microsoft’s release noting a Remote Code Execution vulnerability (CVE-2026-32191) without mentioning PoC, exploit code, or patch details.
#securityupdate #microsoft #定例外 CVE-2026-32191 Security Vulnerability 影響: リモートでコードが実行される 最大深刻度: 緊急 CVSS:3.1 9.8 / 8.5 悪用可能性 ・一般に公開: No ・悪用: No ・Exploitability assessment: 対象外 https://x.com/kawn2020/status/2036268966935736436
Post summary
A new CVE-2026-32191 vulnerability that allows remote code execution has been disclosed, with high CVSS scores, but no PoC, exploit, or active exploitation has been reported.
CVE-2026-32191: Microsoft Bing Images OS Command Injection - What It Means for Your Business and How to Respond https://hubs.li/Q04tX4850
Post summary
The article announces a newly identified OS command injection vulnerability in Microsoft Bing Images and discusses its potential business impact and general response recommendations.
⚠️ ALERTA DE VULNERABILIDAD 📅 24/07/2026 💥 Impacto: Ejecución de código 🔴 Severidad: Crítica 🎯 CVEs: CVE-2026-32194, CVE-2026-32191, CVE-2026-21536 Afecta a productos de Microsoft (Bing e imágenes). ¡Aplica parches oficiales! #Cybersecurity #TechNews #CVE #Infosec https://t.co/DhvxeyEdKM
Post summary
The tweet alerts about critical code‑execution CVEs affecting Microsoft Bing and images, and announces that official patches are available.
A base64 SVG in the imageBin field reached Bing's /images/kblob endpoint and executed commands as root. XBOW disclosed two unauthenticated command-injection flaws in the image pipeline. CVE-2026-32194 affected the public Search by Image path. CVE-2026-32191 affected the crawler path via an attacker-controlled imgurl fetched by bingbot/2.0. Both routes fed the same conversion logic. The SVG referenced an external image whose href began with a pipe. ImageMagick treated the reference as a delegate shell command during rasterization because the worker's policy.xml left delegates unrestricted. A one-pixel PoC ran a command on the worker and curled the output back. Linux hosts returned uid=0. Windows Server 2022 hosts ran as NT AUTHORITY\SYSTEM with SeImpersonatePrivilege enabled. Microsoft patched server-side in March 2026. The writeup appeared July 23. The same ImageMagick delegate pattern that failed in 2016 still reached production image fleets when policy files stayed permissive.
Post summary
Bing’s image pipeline was compromised via a base64‑encoded SVG that triggered command injection, allowing execution as root on Linux and SYSTEM on Windows. Microsoft issued a patch in March 2026, but the vulnerability was actively exploited before that.
#Microsoft released Security Update to address a Remote Code Execution Vulnerability in Microsoft Bing Images. #CVE-2026-32191 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191
Post summary
Microsoft issued a security update for CVE‑2026‑32191, which is a Remote Code Execution flaw in Bing Images.
🚨*CVE* CVE-2026-32191 Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code ov… https://www.cve.org/CVERecord?id=CVE-2026-32191 ----- Traducción: CVE-2026-32191 Neu… http://infoflow.cloud`
Post summary
A new CVE-2026-32191 is disclosed, describing an os command injection in Microsoft Bing Images that permits code execution; no PoC, exploit, or patch details are reported.
CVE-2026-32191 Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code ov… https://www.cve.org/CVERecord?id=CVE-2026-32191
Post summary
The post announces CVE-2026-32191, an OS command injection flaw in Microsoft Bing Images that permits code execution, with no mention of exploitation, PoC, or patch availability.
Microsoft Bing Images Remote Code Execution Vulnerability CVE: CVE-2026-32191 PT-Identifier: PT-2026-26364 Vendor: Microsoft Product: Microsoft Bing Images CVSS: 9.8 Credits: n/a Description: Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-32191 • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191 #dbugs_vuln
Post summary
The text announces a high‑severity OS command injection vulnerability in Microsoft Bing Images (CVE‑2026‑32191) and provides technical details, but does not mention a PoC, exploit code, active exploitation, or patch.
[CVE-2026-32191: CRITICAL] Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.#cve,CVE-2026-32191,#cybersecurity https://cvefind.com/CVE-2026-32191
Post summary
The post announces a critical OS command injection vulnerability in Microsoft Bing Images (CVE-2026-32191), describing the flaw but providing no PoC, exploit code, active exploitation, or patch information.
🔴 CVE-2026-32191 - Critical Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network. https://www.thehackerwire.com/vulnerability/CVE-2026-32191/ https://t.co/6LwrLZn8Il
Post summary
The tweet announces a critical OS command injection vulnerability in Microsoft Bing Images, providing basic technical details but no evidence of active exploitation, PoC, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | bing_images | - | - | - |