MSNightmare has Released a Windows Defender Update DoS Vulnerability Called BigDiskBuster

Security researcher MSNightmare, also known as Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept denial-of-service technique designed to stop Microsoft Defender Antivirus from completing platform and security-intelligence updates. The project is presented as a successor to UnDefend.

The researcher claims it works across all supported Windows versions, although the experimental code remains buggy; compatibility has not been independently verified.

BigDiskBuster does not directly switch off Defender. Instead, it watches the C: volume for changes involving Defender’s Platform and Definition Updates directories. When a new update directory appears, the program checks available disk capacity and creates a hidden, delete-on-close file under the user’s temporary directory, requesting the remaining free space.

If files are modified or removed during the update attempt, additional worker threads try to reclaim newly available capacity, repeatedly starving the installer of storage.

The PoC also opens Windows’ Malicious Software Removal Tool binary, MRT.exe, with restrictive sharing permissions. This can prevent another process from obtaining write or delete access while the handle remains open.

Together, disk exhaustion and file locking interfere with update staging, installation, and rollback operations. Once the monitored Defender update directory disappears, the program interprets that event as a failed update, closes its temporary-file handles, and releases the allocated disk space.

A screenshot supplied with the disclosure shows Windows Security reporting “Protection definition update failed,” error code 0x80070643, and a fatal installation error while the console logs BigDiskBuster detecting an update and allocating temporary files.

This shows the researcher’s test, not independent confirmation. Error 0x80070643 is also a generic installation failure with several possible causes, so defenders should not treat that code alone as proof of exploitation.

The security impact is significant because Defender depends on separate security-intelligence, engine, and platform updates. Microsoft says intelligence packages deliver current detection content, while platform and engine releases maintain supported antivirus components.

Blocking these channels could leave an endpoint running apparently active protection while its ability to recognize emerging malware steadily deteriorates.

Administrators should monitor free-space collapses, unusual hidden files created in user Temp directories, persistent handles to MRT.exe, and repeated Defender update failures.

Microsoft documents update events in Applications and Services Logs under Microsoft, Windows, Windows Defender, Operational; Event ID 2000 records a successful signature update, making missing successes and recurring failures useful hunting signals.

Because the repository describes an experimental PoC, organizations should avoid treating every Defender update error as an attack. Validate affected hosts, preserve process and file-handle telemetry, terminate the suspicious process, recover disk capacity, and force a trusted update.

Microsoft supports updates through Windows Update, WSUS, the Windows Security app, and MpCmdRun.exe; compromised systems should also receive broader incident-response review.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC