CVE-2026-32191: Microsoft Bing Images Remote Code Execution via Crawler Ingestion Path

This is the second route into the same Bing Images processing pipeline. Instead of uploading a file, the attacker gets Bing's crawler to fetch an image from a URL they control. The fetched file lands in the same ImageMagick delegate handler.

The same pipe-prefixed SVG runs operating system commands on the backend workers, with no authentication. Microsoft rates it 9.8 Critical and fixed it server-side before the advisory. Together with CVE-2026-32194 and CVE-2026-21536, the three findings put XBOW in the top 10 of Microsoft's bug bounty leaderboard.