CVE-2026-32194: Microsoft Bing Images Remote Code Execution via Search by Image Upload

Bing's Search by Image feature accepts an uploaded image from any visitor and hands it to an ImageMagick-backed processing pipeline. ImageMagick's delegate handler treats a filename that starts with a pipe character as a command to run.

A one-pixel SVG whose image reference begins with a pipe escapes the handler and runs commands on Bing's production workers, as NT AUTHORITY\SYSTEM on Windows and root on Linux. No account, cookie or user interaction is needed. Microsoft rates it 9.8 Critical and fixed it server-side before publishing the advisory. XBOW held the exploit details until July at Microsoft's request.