Bing Images and SVG attack: why image-processing bugs are a cybersecurity risk

Colleagues, I’d like to flag a cybersecurity story: Bing Images has two critical vulnerabilities.

A crafted SVG could execute commands on Microsoft servers with SYSTEM privileges on Windows and root on Linux. The CVSS score is 9.8. The issue was found by XBOW and reported to Microsoft.

Importantly, the patch has already been deployed server-side, so users do not need to take any action. However, the broader risk remains.

If your environment processes images through ImageMagick or similar converters, check whether delegates are disabled, SVG handling is restricted, and workers are isolated without network access.

Why this matters: an image handler can become an RCE entry point if it is trusted as “just an image.”

Are your pipelines already isolated?

#cybersecurity #vulnerability #Microsoft #AppSec