Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft’s Servers, Leaving Thousands Exposed
A serious vulnerability has been discovered in Bing Images, allowing attackers to craft malicious SVG files that can execute commands with elevated privileges on Microsoft’s servers. The flaw, which was uncovered by a security researcher, affects thousands of users who upload images to the platform.
The weakness revolves around how Bing Images handles uploaded SVG files, which are essentially vector graphics designed to scale and resize without losing quality. In this case, a specially crafted SVG file can be used as a vector for malicious code execution. When an attacker uploads such a file, it can potentially run arbitrary commands on Microsoft’s servers with SYSTEM privileges, allowing the hacker to access sensitive data or even take control of the server.
The vulnerability is particularly concerning because Bing Images has millions of users worldwide who upload images to the platform daily. While it’s unclear at this point how many users are affected by the flaw, the potential for widespread exploitation is significant. Microsoft has been notified of the issue and is working on a patch, but in the meantime, users should be cautious when uploading files to the platform.
The security researcher who discovered the vulnerability explained that the issue lies in the way Bing Images processes SVG files. When an SVG file is uploaded, it’s stored on Microsoft’s servers without being sanitized or filtered for malicious code. This allows attackers to inject commands into the file, which can then be executed by the server with elevated privileges. The researcher demonstrated the flaw by crafting a simple SVG file that, when uploaded, ran a command to list all files in the current directory.
The discovery of this vulnerability highlights the importance of robust security measures in cloud-based services like Bing Images. As more organizations rely on these platforms for data storage and processing, the need for secure design and implementation becomes increasingly critical. In this case, Microsoft’s failure to properly sanitize uploaded SVG files has left thousands of users vulnerable to attack.
In light of this incident, it’s essential for users to exercise caution when uploading files to cloud-based services. While the vulnerability in Bing Images is specific to Microsoft’s servers, it serves as a reminder that attackers can exploit even seemingly innocuous features like image uploads to gain unauthorized access to sensitive data or systems. To mitigate risks, organizations should implement robust security measures, including regular software updates and thorough testing for vulnerabilities.
Ultimately, this incident underscores the need for more comprehensive security protocols in cloud-based services. By prioritizing secure design and implementation, service providers can minimize the risk of exploitation by attackers. For users, it’s essential to stay informed about potential vulnerabilities and take proactive steps to safeguard their data and systems.
Source: The Hacker News — 2026-07-24