Microsoft Bing has a vulnerability that allows an attacker to deserialize untrusted data and execute arbitrary code. The flaw is a classic deserialization weakness (CWE‑502) that can give an unauthorized user the ability to run malicious code via the network, potentially giving them full control over the affected system.

Any deployment of Microsoft Bing. No specific version numbers are listed in the advisory, so all current and future releases are likely affected until an update is applied.

The CVSS score of 10 highlights the maximum severity of the issue. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild at the time of this analysis, and the vulnerability is not yet in the CISA KEV catalog. The attack can be performed remotely over a network by sending specially crafted data to the Bing service, assuming the attacker can reach the target. Because the flaw is a deserialization bug, any data payload that can be crafted by the attacker and delivered to the service may trigger the vulnerability.