Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

Vulnerabilities in Bing Images allowed specially crafted SVG files to execute commands with high privileges on Microsoft's servers. These commands could run as NT AUTHORITY\SYSTEM on Windows machines and as root on Linux machines within the same fleet. The issue was not isolated to a single machine, but rather was a problem with Bing's image processing tier. Microsoft addressed the vulnerabilities by issuing two critical CVEs. The flaws could be exploited by submitting a crafted SVG to Bing's image search. The vulnerabilities were identified by XBOW during testing across different hosts and network ranges.