Bing Images SVG Flaw Achieved SYSTEM/Root RCE on Microsoft's Production Workers

Sat, 25 Jul 2026 12:08:50 +0000

Engineer — Learn: The vulnerability sat in Microsoft’s own infrastructure and is already patched, but the technique — crafted SVG triggering RCE in a server-side image processing pipeline — is directly generalizable. Audit any service that accepts user-submitted SVGs and processes them server-side (ImageMagick, librsvg, Inkscape CLI, etc.) for equivalent exposure.
SOC/IR — Skip
Leader — Learn: A research disclosure showing critical RCE in a major cloud vendor’s production infrastructure; Microsoft has issued CVEs and presumably patched. No action required but it’s a useful data point on shared-responsibility boundaries when cloud vendors process user-submitted content.
Signals: CVE-2026-32194 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Svg-Injection on CuraSec