Bing Images SVG bug lets attackers run code as SYSTEM or root
A malicious SVG uploaded to Bing's image search triggered command injection on Microsoft's production image‑processing fleet, executing as NT AUTHORITY\SYSTEM on Windows workers and as root on Linux nodes. Microsoft issued CVE‑2026‑32194 and CVE‑2026‑32191, both scoring 9.8, and patched the flaw server‑side.