{"vulnerability": "CVE-2026-32194", "sightings": [{"uuid": "7b3925fa-425d-4819-a46e-dc886df098cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgzt36d6o2d", "content": "", "creation_timestamp": "2026-03-19T22:18:20.210116Z"}, {"uuid": "15eba975-7bb8-4bf6-937e-0e032ade5fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-32194", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mhngbpyxov2d", "content": "", "creation_timestamp": "2026-03-22T11:17:14.611068Z"}, {"uuid": "c68e8359-0e85-4f0a-b09e-d60be293bdcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhh3gnuv4c2e", "content": "", "creation_timestamp": "2026-03-19T22:47:10.279206Z"}, {"uuid": "f2d175f6-30d7-4f2a-bcc2-46de93ed6904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://t.me/ZerodayAlert/781", "content": "\u041e\u0434\u0438\u043d SVG-\u0444\u0430\u0439\u043b \u0434\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Microsoft \u0447\u0435\u0440\u0435\u0437 Bing\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b XBOW \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u0440\u0435\u0432\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0443 \u0432 \u0442\u043e\u0447\u043a\u0443 \u0432\u0445\u043e\u0434\u0430 \u0432\u043d\u0443\u0442\u0440\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Bing. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 SVG \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Microsoft \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438: SYSTEM \u0432 Windows \u0438 root \u0432 Linux.\n\n\u041a\u043e\u0440\u0435\u043d\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439. Bing \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u043b \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u044b\u0437\u044b\u0432\u0430\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0431\u0435\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e \u0441\u0443\u0442\u0438, \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438\u043d\u044f\u043b \u0447\u0430\u0441\u0442\u044c \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u0437\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e. \u0410\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0434\u0430\u0436\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0430 \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0439 \u0440\u043e\u0431\u043e\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b \u0431\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e.\n\nMicrosoft \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0434\u0432\u0435 \u0434\u044b\u0440\u044b CVE-2026-32194 \u0438 CVE-2026-32191 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u0435\u0442\u0430\u043b\u0435\u0439. \u0418\u0441\u0442\u043e\u0440\u0438\u044f \u0441\u043d\u043e\u0432\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0441\u0442\u0430\u0440\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443: \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0435\u0440\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0447\u0430\u0441\u0442\u043e \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \u041d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0439\u0442\u0435 \u0442\u0430\u043a\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0441 \u0448\u0438\u0440\u043e\u043a\u0438\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438 \u0443\u0431\u0438\u0440\u0430\u0439\u0442\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0444\u043e\u0440\u043c\u0430\u0442\u044b \u0438\u0437 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438.\n\n#Bing #SVG #Microsoft #ImageMagick\n\n@ZerodayAlert", "creation_timestamp": "2026-07-30T06:00:04.270192Z"}, {"uuid": "9c43c746-2951-41d2-9c0f-deaa621df794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://t.me/ZerodayAlert/781", "content": "\u041e\u0434\u0438\u043d SVG-\u0444\u0430\u0439\u043b \u0434\u0430\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Microsoft \u0447\u0435\u0440\u0435\u0437 Bing\n\n\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b XBOW \u043d\u0430\u0448\u043b\u0438 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u0440\u0435\u0432\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0443 \u0432 \u0442\u043e\u0447\u043a\u0443 \u0432\u0445\u043e\u0434\u0430 \u0432\u043d\u0443\u0442\u0440\u044c \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Bing. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 SVG \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Microsoft \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438: SYSTEM \u0432 Windows \u0438 root \u0432 Linux.\n\n\u041a\u043e\u0440\u0435\u043d\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439. Bing \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u043b \u043d\u0435\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u044b\u0437\u044b\u0432\u0430\u043b\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0431\u0435\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u043e \u0441\u0443\u0442\u0438, \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438\u043d\u044f\u043b \u0447\u0430\u0441\u0442\u044c \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u0437\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e. \u0410\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u0434\u0430\u0436\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0430 \u043a\u0430\u0440\u0442\u0438\u043d\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0439 \u0440\u043e\u0431\u043e\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b \u0431\u044b \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e.\n\nMicrosoft \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0434\u0432\u0435 \u0434\u044b\u0440\u044b CVE-2026-32194 \u0438 CVE-2026-32191 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u0435\u0442\u0430\u043b\u0435\u0439. \u0418\u0441\u0442\u043e\u0440\u0438\u044f \u0441\u043d\u043e\u0432\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0441\u0442\u0430\u0440\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443: \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0435\u0440\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0447\u0430\u0441\u0442\u043e \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \u041d\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0439\u0442\u0435 \u0442\u0430\u043a\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0441 \u0448\u0438\u0440\u043e\u043a\u0438\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438 \u0443\u0431\u0438\u0440\u0430\u0439\u0442\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u0444\u043e\u0440\u043c\u0430\u0442\u044b \u0438\u0437 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438.\n\n#Bing #SVG #Microsoft #ImageMagick\n\n@ZerodayAlert", "creation_timestamp": "2026-07-31T01:00:23.159470Z"}, {"uuid": "d56276f8-daf7-47d3-b925-8b0505ae16ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://t.me/pphm_HackerNews/2294", "content": "\ud83d\udd34 Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers\n\nA crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and CVE-2026-32191, and rated both 9.8 on the CVSS scale.\n\nXBOW, the autonomous offensive security startup, found both and reported them privately. Bing users have no patch or mitigation to apply: Microsoft fixed both server-side before the advisories went out in March, and the records state there is \"no customer action to resolve.\"", "creation_timestamp": "2026-08-21T23:00:07.844003Z"}, {"uuid": "f8343e67-a185-4c30-a02a-62d2ba99b368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mofzkbukz22m", "content": "\ud83d\udccc CVE-2026-32194 - Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execut... https://www.cyberhub.blog/cves/CVE-2026-32194", "creation_timestamp": "2026-06-16T14:37:30.339440Z"}, {"uuid": "77fcc5e5-bd1e-4c5f-895d-36131a12877b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://t.me/pphm_HackerNews/2294", "content": "\ud83d\udd34 Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers\n\nA crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and CVE-2026-32191, and rated both 9.8 on the CVSS scale.\n\nXBOW, the autonomous offensive security startup, found both and reported them privately. Bing users have no patch or mitigation to apply: Microsoft fixed both server-side before the advisories went out in March, and the records state there is \"no customer action to resolve.\"", "creation_timestamp": "2026-08-22T00:00:11.412883Z"}, {"uuid": "80b9fcc1-06e7-4a64-8ff3-a72940fb0821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://t.me/pphm_HackerNews/2294", "content": "\ud83d\udd34 Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers\n\nA crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and CVE-2026-32191, and rated both 9.8 on the CVSS scale.\n\nXBOW, the autonomous offensive security startup, found both and reported them privately. Bing users have no patch or mitigation to apply: Microsoft fixed both server-side before the advisories went out in March, and the records state there is \"no customer action to resolve.\"", "creation_timestamp": "2026-08-23T00:00:45.122469Z"}, {"uuid": "4937d043-b841-4c32-ab07-3aa86b10a0af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mrfkcjhwul2p", "content": "\ud83e\udd16 CVE-2026-32194 & CVE-2026-32195 (critical): Crafted SVGs submitted to Bing Images run commands as SYSTEM on Microsoft's servers. Patches issued by Microsoft.\nhttps://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html", "creation_timestamp": "2026-07-24T14:19:54.207639Z"}, {"uuid": "47d3165f-1030-4c81-ab5b-d6fab8ba80de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html", "content": "A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and", "creation_timestamp": "2026-07-24T16:00:50.931903Z"}, {"uuid": "777b848c-23b0-4124-8617-8970f65c637b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html", "content": "A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and", "creation_timestamp": "2026-07-25T01:00:49.450458Z"}, {"uuid": "57ca0332-30d6-4aef-b55b-edfef9412b98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "seen", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-25T23:00:03.467703Z"}, {"uuid": "79950430-e9a3-4de3-88dc-dfb69628b8ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "published-proof-of-concept", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-26T00:00:14.219311Z"}, {"uuid": "03d328a2-7202-420e-a666-a4cd8fb36cbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-32194", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mrkkgbdyqa2j", "content": "SVG flaws in Bing Images gave RCE as SYSTEM on Microsoft image servers (CVE-2026-32194). Cloud image pipelines are attack surface too. #ThreatIntel #AIsecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/bing-images-svg-command-injection-cve-2026-32194-2026-07", "creation_timestamp": "2026-07-26T14:05:19.240201Z"}, {"uuid": "15b60b2e-a16a-411f-8b4e-ac9d0670162a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "published-proof-of-concept", "source": "https://t.me/VulnerabilityNews/43646", "content": "Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers\n\nA crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and\nhttps://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html", "creation_timestamp": "2026-09-18T08:00:05.869166Z"}, {"uuid": "038fb766-9962-4c85-a667-d2d665855e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-32194", "type": "published-proof-of-concept", "source": "https://t.me/VulnerabilityNews/43646", "content": "Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers\n\nA crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet.\n\nXBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and\nhttps://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html", "creation_timestamp": "2026-09-19T00:00:43.392804Z"}]}