Three critical remote code execution vulnerabilities discovered in Microsoft’s infrastructure, two of them inside Bing Images, show how a routine feature like image upload can quietly evolve into a full server takeover. All three have since been patched, but the technical path attackers could have taken is worth understanding, because the underlying bug class is far from new.

Three Flaws, One Maximum Severity Score

Microsoft classified all three vulnerabilities as Critical, each carrying the maximum possible CVSS score of 9.8. The first is a command injection flaw in Bing’s image-processing pipeline, reachable through the public-facing “Search by Image” upload feature. A closely related second flaw affects a server-side image ingestion path tied to Bing’s reverse image search crawler. A third, unrelated issue involves unrestricted file upload within the Microsoft Devices Pricing Program. The findings were credited to XBOW, an autonomous AI-driven security research system that reportedly climbed into the top ten of Microsoft’s bug bounty leaderboard, a first for an AI-based researcher.

An Accidental Discovery That Unraveled Into SSRF, Then RCE

The investigation reportedly began almost by chance. Bing’s reverse image search could be coaxed into fetching an attacker-controlled URL on the backend, a textbook server-side request forgery pattern that, taken alone, looked relatively low stakes. Researchers confirmed the outbound fetch by watching for requests carrying Bing’s crawler user agent, then noticed something odd: inconsistent server errors that suggested the backend was doing more with the fetched content than simply displaying it.

That anomaly prompted a deeper question, whether the fetched file was actually being parsed by a vulnerable component. After ruling out XML external entity attacks, researchers zeroed in on an ImageMagick-style rendering engine processing SVG files through its coder and delegate system. Because SVG is XML-based, it can reference external resources and, in vulnerable configurations, trigger pseudo-protocols capable of piping data into a shell.

• A pipe-prefixed shell command embedded inside an SVG reference was passed to the image conversion library.
• Instead of rendering the file as an image, the backend executed the embedded command as an operating system instruction.
• The payload could reach the vulnerable pipeline either through direct upload or via the SSRF-driven crawler fetch.

Confirmed Execution as SYSTEM, Across Multiple Hosts

Because the visible HTTP response returned only generic errors, researchers confirmed successful exploitation through out-of-band callbacks rather than anything visible on the page itself. Those callbacks showed command execution running as NT AUTHORITY\SYSTEM on Bing’s image-processing workers, which were running Windows Server 2022 Datacenter. The team reproduced the result across multiple hosts and network ranges, indicating the exposure spanned Bing’s entire image-processing tier rather than a single misconfigured machine. Notably, the researchers’ automated validation tooling initially missed Linux-based workers entirely, since it was tuned to recognize Linux-style proof-of-execution output; only after retooling it to also catch Windows-specific commands did the full scope of affected infrastructure become clear.

An Old Bug Class in New Infrastructure

Command injection through image converters is not a novel discovery. Similar flaws have plagued software for years, echoing incidents like ImageTragick and various ExifTool-based remote code execution bugs disclosed through bug bounty programs. What makes this case notable is less the technique and more the target: applications tend to treat image parsing libraries as inert plumbing, when in reality these components carry decades of format-compatibility code and shell-out behavior that attackers can weaponize the moment untrusted input reaches them.

Lessons for Defenders Running Similar Pipelines

Microsoft has fully remediated both Bing Images vulnerabilities, but the broader lesson extends well past one company’s infrastructure. Organizations running comparable image-processing pipelines should disable shell-invoking delegates and pipe-based behavior in ImageMagick-style converters, and should enforce restrictive policy configurations that disallow high-risk formats such as SVG, MVG, and EPS unless a real business need exists. Any feature that fetches user-supplied URLs deserves strict egress controls, including destination allowlists and blocking of internal address ranges, and image conversion itself should run inside sandboxed environments with reduced privileges and constrained outbound network access. Validation and detection tooling should also account for heterogeneous server fleets, since, as this case showed, missing half your infrastructure’s operating systems in a proof-of-concept harness can mean missing half the real exposure.