🚨 A Single SVG File Almost Gave Hackers SYSTEM Access to Microsoft's Servers
No phishing. No malware. No stolen creds. Just an image upload that turned into full remote code execution on production infrastructure.
Researchers uncovered 3 critical RCE vulnerabilities in Microsoft's infra — two inside Bing Images, both rated CVSS 9.8. All three were found by XBOW, an autonomous AI security research platform that reportedly became the first AI to rank in the top 10 of Microsoft's bug bounty leaderboard.
The vulnerable feature was Bing's public "Search by Image" upload — no login required.
The bug, for devs building anything similar:
SVG isn't a flat image — it's an XML document that can reference external resources. Bing's backend used an ImageMagick-style engine with "delegates" enabled. A pipe-prefixed command inside an SVG reference got executed as a real OS command instead of being rendered.
Result: command execution as NT AUTHORITY\SYSTEM on Windows workers, root on Linux workers — reproduced across multiple hosts in the fleet.
Microsoft's patched it server-side. But if your app touches user-uploaded images in any way, this is worth an afternoon of your time:
→ Lock down policy.xml / delegates.xml
→ Block SVG/MVG/EPS on public upload paths unless explicitly needed
→ Sandbox image conversion, no outbound network by default
→ Enforce egress allowlists on any URL-fetching feature
Full technical breakdown (CVEs, investigation trail, detection steps):
🔗 https://www.xpert4cyber.com/2026/07/bing-images-rce-vulnerability-system-access.html
Top comments (0)