Microsoft Fixes Critical Bing Images Vulnerability That Enabled SYSTEM-Level Code Execution via SVG Files
A recently disclosed flaw in Bing Images allowed attackers to submit malicious SVG files that executed arbitrary commands with SYSTEM privileges on Microsoft’s backend servers, posing severe risks to infrastructure and u…
A dangerous security weakness in Microsoft’s Bing Images service has been uncovered, highlighting how even well-established web platforms can be exploited through overlooked file processing paths. The flaw resided in the way Bing Images handled uploaded Scalable Vector Graphics (SVG) files, a widely used image format that can embed JavaScript and other active content. By crafting a specially modified SVG, an attacker could trigger server‑side rendering flaws that ultimately led to remote code execution (RCE) with SYSTEM‑level privileges on Microsoft’s own servers.
The attack worked because SVG images, unlike raster formats such as PNG or JPEG, are XML‑based and can include script elements and event handlers. When a server processes such a file—for example, to generate thumbnails, validate content, or convert formats—it may inadvertently execute embedded code if proper sanitisation is not in place. In this case, the researcher or threat actor (details of disclosure remain limited) demonstrated that a carefully constructed SVG uploaded to Bing Images would be processed in a way that permitted command execution, giving the attacker full control over the underlying server. The SYSTEM access level is the highest possible on Windows machines, meaning the attacker could install malware, access sensitive data, or move laterally within Microsoft’s network.
For businesses and website operators, this incident is a stark reminder that any user‑supplied content—images, documents, even metadata—can become an attack vector if not rigorously validated. SVG files are especially treacherous because they blur the line between static images and executable code. Many web applications accept SVG uploads for logos, icons, or user avatars, often without stripping out active content. The recommended defences include serving uploaded files from a separate domain with a restrictive Content‑Security‑Policy, sanitising SVGs using proven libraries that remove scripts, and avoiding passing them through interpreters like ImageMagick or other rendering engines that may have their own vulnerabilities. Microsoft has since patched the Bing Images flaw, though the company has not disclosed technical details about the fix or whether the vulnerability was actively exploited.
Managed hosting environments can help site owners sidestep these risks by providing hardened server configurations and automatic input filtering. AEU Hosting, for example, applies multiple layers of security—from web application firewalls to real‑time malware scanning—that are designed to catch and neutralise malicious uploads before they ever reach the application backend. For organisations running WordPress or custom sites, such protections can make the difference between a silent intrusion and a resilient defence without daily manual oversight.