Microsoft Let a Doodle Run the Whole Farm
I want you to sit with this for a moment.
A picture. A drawing. A crafted SVG file, which is, for those of you who still remember when image formats had the decency to be flat and stupid, essentially a text file dressed up in a turtleneck. Someone submitted one to Bing's image search, and it ran commands as NT AUTHORITY\SYSTEM on Microsoft's production servers.
SYSTEM. The top of the food chain. The keys to the entire pen.
In my day, the most dangerous thing an image could do was jam the dot-matrix printer. We did not give our pictures administrative privileges.
The researchers at XBOW did not find one compromised machine, either. They found the same result across multiple workers on different hosts and different network ranges. This was not a rogue sheep. This was a systemic failure baked into Bing's entire image-processing tier. The fleas were in the whole flock's wool, not just one unlucky lamb.
Two critical CVEs have been issued: CVE-2026-32194 and a companion. Microsoft has patched, which is fine, I suppose. The Shepherds in Redmond have applied some ointment. Congratulations. Perhaps next time apply it before the wound opens.
I keep telling anyone who will listen: the moment you let the flock upload arbitrary files into your Sky Pasture infrastructure without treating every single one as a potential wolf in disguise, you have already lost. An SVG is not a photograph of a meadow. It is a programmable document. Parsing it on a privileged worker is, professionally speaking, a catastrophic failure of imagination.
The Electric Fence was presumably present. It did nothing. Fences do not help when you are handing the wolf a staff badge and a parking permit.
Remediation
I should not have to say these things. And yet.
One. Strip and sanitize every uploaded file as if it arrived from a hostile foreign intelligence service. Because it might have.
Two. Your image-processing workers have no business running as SYSTEM or root. Least privilege. Look it up. We understood this concept on machines with 640 kilobytes of RAM.
Three. Isolate your parsing infrastructure. Air-gap the thing if you have to. In the old days we would have run that process on a separate machine connected by a cable the length of a football field. Consider it.
Four. Apply your shearing schedule before researchers find the holes in your fence and publish them for the entire internet to read.
The flock does not know any of this happened, of course. They are still searching Bing for pictures of sunsets.
Stay paranoid, it costs nothing.
Original Report: https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html