DNA View

Critical Severity Vulnerability

This vulnerability has been rated as Critical severity. Immediate action is recommended.

CVE-2026-32191

Critical

Low Medium High Critical

9.8

CVSS Score

Published: Mar 19, 2026

Last Modified: Apr 14, 2026

CWE: CWE-78

Vulnerability Description

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

1 configuration(s) from 1 vendor(s)

bing_images

Version:

CPE:

cpe:2.3:a:microsoft:bing_images:-:*:*:*:*:*:*:*

This vulnerability affects 1 software configuration(s). Ensure you patch all affected systems.

References & Resources

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191
secure@microsoft.com Vendor Advisory

Severity Details

9.8

out of 10.0

Critical

Weakness Type (CWE)

CWE-78 Top 25 #13

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a…
Exploit Likelihood: High
Typical Severity: High
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base