CVE-2026-32194

Name of the Vulnerable Software and Affected Versions Microsoft Bing Images (affected versions not specified)

Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized remote attacker to execute arbitrary code over a network. The issue occurs when specially crafted SVG files are uploaded to the image search, enabling the attacker to achieve NT AUTHORITYSYSTEM privileges on Windows production image-processing workers and root privileges on Linux machines. This systemic flaw affects workers across different hosts and network ranges within the image tier.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.