Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

Attackers could craft malicious SVG files to exploit ImageMagick's delegate functionality and shell command injection vulnerabilities, achieving full SYSTEM-level code execution on Microsoft's Bing image-processing infrastructure. The root issue lies in trusting user-supplied file content without sufficient sanitization before passing it to a powerful, feature-rich third-party processing library. ImageMagick's delegate system, which invokes shell commands to handle certain file formats, has a well-documented history of dangerous misuse — yet it remained insufficiently hardened in this production environment. This matters because server-side image processing pipelines are a common but underestimated attack surface, and SYSTEM/root-level compromise means complete loss of server confidentiality, integrity, and availability.