An attacker can exploit improper neutralization of special elements in an operating system command, leading to a command injection that permits unauthorized code execution over a network.

Microsoft Bing Images is the affected product. Version information is not specified, so all deployments that utilize Bing Images are potentially vulnerable.

The vulnerability carries a CVSS score of 9.8, indicating a very high severity, but its EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated user sending specially crafted requests to the Bing Images service over the network, which can trigger execution of arbitrary system commands.