25 July 2026 - 08:13
Category: IT Fail
Bing Images Grants Root For Free
Bing Image search let malicious SVGs execute commands as SYSTEM and root on Microsoft servers. Because why limit damage to just one OS?
Source: The Hacker News
The Full Story
Microsoft delightfully demonstrated how submitting a crafted SVG to Bing image search grants full NT AUTHORITY SYSTEM execution on Windows servers. For complete operational fairness, it also granted root access on their Linux image-processing fleet during XBOW's testing. Microsoft's own production infrastructure took the hit, proving that even tech giants fail at basic input sanitisation. Defending ourselves against such laughable exploits means properly isolating server fleets and handling vector graphics without handing over full administrative keys.