Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
Researcher publishes unpatched BigDiskBuster PoC that can block Microsoft Defender signature and platform updates.
Researcher Abdelhamid Naceri published BigDiskBuster on September 19, an unpatched proof-of-concept with no CVE that can stop Microsoft Defender from installing platform and signature updates by filling free disk space. Defender keeps running, but its detection content can go stale. His earlier tools BlueHammer, RedSun, and UnDefend were exploited before Microsoft patched them; UnDefend was fixed in May as CVE-2026-45498, and that patch is not shown to cover this different method. No independent confirmation of BigDiskBuster has been reported.
- BigDiskBuster was published September 19 with no patch, CVE, or advisory.
- The PoC exhausts disk space so Defender platform and signature updates fail.
- Naceri's earlier Defender tools were exploited before Microsoft patched them.
- UnDefend was fixed in May as CVE-2026-45498; coverage here is unproven.
- No independent researcher has confirmed BigDiskBuster's claimed behavior.
- CVEs
- CVE-2026-45498
- Vendors
- Microsoft
- Products
- Microsoft DefenderWindows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-45498 | Denial-of-Service Vulnerability in Microsoft Defender Antimalware Platform | 7.5 | 63% | KEV | KEV |
From the original article
2 min read at thehackernews.com
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.