Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
Researcher publishes unpatched BigDiskBuster PoC that can block Microsoft Defender signature and platform updates.
Researcher Abdelhamid Naceri published BigDiskBuster on September 19, an unpatched proof-of-concept with no CVE that can stop Microsoft Defender from installing platform and signature updates by filling free disk space. Defender keeps running, but its detection content can go stale. His earlier tools BlueHammer, RedSun, and UnDefend were exploited before Microsoft patched them; UnDefend was fixed in May as CVE-2026-45498, and that patch is not shown to cover this different method. No independent confirmation of BigDiskBuster has been reported.
- BigDiskBuster was published September 19 with no patch, CVE, or advisory.
- The PoC exhausts disk space so Defender platform and signature updates fail.
- Naceri's earlier Defender tools were exploited before Microsoft patched them.
- UnDefend was fixed in May as CVE-2026-45498; coverage here is unproven.
- No independent researcher has confirmed BigDiskBuster's claimed behavior.
Vulnerabilities mentionedAll →
- CVE-2026-454987.51%Denial-of-Service Vulnerability in Microsoft Defender Antimalware Platformpublished · Microsoft Defender (antimalware platform) KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45498 | Denial-of-Service Vulnerability in Microsoft Defender Antimalware Platform CVE-2026-45498 is a denial-of-service flaw (CWE-400, uncontrolled resource consumption) in the Microsoft Defender antimalware platform, rated 7.5 (High) with a network attack vector and no privileges or user interaction required. A remote, unauthenticated attacker can trigger excessive resource consumption that disrupts the Defender service, with high impact on availability but no confidentiality or integrity impact per the CVSS scoring. An attacker gains the ability to crash, hang, or disable antimalware protection on targeted systems, potentially leaving endpoints temporarily unprotected. Any deployment of Microsoft Defender — which is the default antimalware on modern Windows and is also deployed as a cloud service — is in scope, and CISA's required action explicitly points defenders to BOD 22-01 guidance for cloud services. The flaw has been added to CISA's KEV catalog (2026-05-20), EPSS assigns it a 63.1% probability of exploitation within 30 days, and headlines confirm it is being exploited in the wild alongside CVE-2026-41091. |
Full article485 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 22, 2026Vulnerability / Endpoint Security
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19.
The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in attacks.
When updates are blocked, Defender keeps running, but its detection content grows stale. The researcher's screenshot shows Defender returning a generic Windows error when trying to update, but whether the failure raises an automatic alert is not clear from the proof-of-concept alone.
Naceri said he was dismissed from Microsoft's Security Response Center in 2024 and has been releasing exploits without coordinating with the company since April.
His first three Defender tools — BlueHammer, RedSun, and UnDefend — were all exploited in live intrusions before Microsoft patched them and CISA added all three to its Known Exploited Vulnerabilities catalog. He has since disclosed additional Defender and Windows flaws roughly monthly.
BigDiskBuster watches the C:\ drive for new directories under Defender's update paths. When Defender begins downloading a platform or definition update, the tool creates a hidden temporary file sized to fill all remaining free space, and the update fails.
Once the update fails and Defender removes its staging directory, the tool deletes the file and waits for the next attempt. It also opens a handle on MRT.exe, the Windows Malicious Software Removal Tool, in a way that would block Windows Update from replacing it.
Naceri describes the tool as "a bit buggy and needs some rewritting" and says it seems to work on all supported Windows versions. No independent researcher has confirmed the claimed behavior.
Naceri calls BigDiskBuster "similar to UnDefend," a Defender denial-of-service flaw he disclosed in April that blocked definition updates through a different method. Microsoft patched it in May as CVE-2026-45498 in Antimalware Platform version 4.18.26040.7.
The two tools work differently. UnDefend used uncontrolled resource consumption, while BigDiskBuster fills the disk so Defender's update directories cannot grow. Whether the May patch also covers this new technique is not established, and the different mechanism suggests it does not.
What Defenders Should Do
No patch or vendor workaround exists for BigDiskBuster.
Administrators can check that Defender's signatures and platform version are current through Windows Security under Virus & threat protection, then Protection updates, then Check for updates. In PowerShell, Get-MpComputerStatus shows the current versions in the AMEngineVersion and AMProductVersion fields.
Monitoring for repeated Defender update failures, sustained low disk space on the system volume, and large hidden files in temporary directories would help detect the technique. Restricting execution of unknown binaries through WDAC or AppLocker would limit an attacker's ability to run the tool.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.