Crafted SVG files uploaded to Microsoft’s Bing Images service can be used to execute arbitrary commands as SYSTEM on internal servers, security researchers have disclosed, highlighting a class of server-side parsing vulnerabilities in image processing pipelines.
The vulnerabilities stem from how Bing’s image processing infrastructure handles Scalable Vector Graphics files. SVGs support embedded scripting and external entity references, and when the parser processes maliciously crafted files without proper sanitization, attackers can achieve code execution on the backend.
Microsoft has addressed the vulnerabilities in a security update. The researchers noted that image processing services are an increasingly attractive attack surface because they automatically process user-supplied files at scale, giving attackers multiple vectors for exploitation.
Organizations using image processing services should audit their SVG handling pipelines and apply the latest Microsoft security patches.
