This vulnerability (CVE-2026-32191) in Microsoft Bing Images involves improper neutralization of special elements used in OS commands, classified as CWE-78 (OS Command Injection). This flaw enables an attacker without privileges or user interaction to execute arbitrary code remotely over the network. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. Microsoft has issued an official fix to address this vulnerability as documented in their security update guide.

Successful exploitation allows remote, unauthorized attackers to execute arbitrary OS commands on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the service. This could result in data breaches, service disruption, or further network compromise.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191 to remediate this vulnerability. Since this is not a cloud service, patching the affected software is required to mitigate the risk.