The vulnerability is an OS Command Injection flaw (CWE-78) where special elements within an OS command are not properly neutralized in Microsoft Bing Images. This defect allows an unauthorized attacker to inject and execute arbitrary OS commands, granting the attacker the ability to run code on the affected system.

The affected product is Microsoft Bing Images. Version information is not provided, so any installation of Bing Images that has not received the Microsoft security update for CVE‑2026‑32191 is potentially vulnerable.

The CVSS score is 9.8, indicating critical severity. EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, the attack vector is network‑based and does not require authentication, implying a high likelihood that an attacker could exploit the flaw if the service is exposed to the internet.