Executive Summary
Security researchers identified critical vulnerabilities in Microsoft Bing's image-processing tier, tracked as CVE-2026-32194 and CVE-2026-32191, which allowed for unauthenticated remote code execution (RCE). The flaws stemmed from ImageMagick's default 'open' security policy, where external delegates—programs invoked via shell to process specific formats—could be triggered by crafted SVG image references starting with a pipe character. This allowed commands to run with high privileges (NT AUTHORITY\SYSTEM on Windows and root on Linux) on production workers.
Technically, the attack vectors included both direct image uploads and server-side requests (SSRF) via URL parameters. While Microsoft has remediated these specific instances server-side, the underlying issue persists for any organization utilizing ImageMagick or compatible suites without a hardened security policy. The vulnerability mirrors the 2016 'ImageTragick' exploit, highlighting a recurring risk where image-processing helpers are treated as passive plumbing rather than active parsers with a significant attack surface.
Impacted organizations include any that process untrusted image uploads or perform server-side image fetching. Failure to restrict ImageMagick delegates can lead to full host compromise, lateral movement via SeImpersonatePrivilege, and data exfiltration if the processing environment is not network-isolated.