Microsoft Bing Images has a flaw where special elements used in command construction are not properly neutralized, allowing attackers to inject arbitrary commands. The vulnerability enables execution of code on the target system, potentially compromising application integrity, confidentiality, and availability. Since the issue is a classic command injection, a successful attack could grant an attacker full control over the affected service or the underlying host.

Microsoft Bing Images is the affected product. No specific version information is disclosed. Administrators should verify which instances of Bing Images are deployed and identify the exact version to determine whether they are exposed.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests that public exploitation is currently limited and the vulnerability is not in the CISA KEV catalog. The likely attack vector is network-based, where an unauthenticated attacker sends crafted requests to the Bing Images service to trigger the command injection. Because arbitrary commands can be executed, the risk to the system and data is significant if the exploit succeeds.