Researchers discovered critical vulnerabilities (CVE-2026-32194 and CVE-2026-32195) in Bing’s image search that allowed crafted SVG files to execute commands as NT AUTHORITY\SYSTEM on Microsoft’s production image-processing workers. The same flaws also granted root access on Linux machines within the same fleet. These issues were found across various hosts and network ranges, indicating a systemic problem within Bing’s image tier.