Improper neutralization of special elements used in a command leads to a command injection flaw in Microsoft Bing Images. The flaw permits an unauthorized attacker to execute arbitrary code over a network, resulting in full remote code execution and compromising the confidentiality, integrity, and availability of the affected system. This vulnerability is classified as CWE-77 (Command Injection).

The vulnerability affects Microsoft Bing Images. No specific version information is provided, so any deployment of the product at present may be susceptible.

The CVSS score of 9.8 indicates a critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based, as the flaw allows code execution over a network. Without an official patch or workaround, the risk remains high for any impacted installation.