A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19.
The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in attacks.
When updates are blocked, Defender keeps running, but its detection content grows stale. The researcher’s screenshot shows Defender returning a generic Windows error when trying to update, but whether the failure raises an automatic alert is not clear from the proof-of-concept alone.
Naceri said he was dismissed from Microsoft’s Security Response Center in 2024 and has been releasing exploits without coordinating with the company since April.
His first three Defender tools — BlueHammer, RedSun, and UnDefend — were all exploited in live intrusions before Microsoft patched them and CISA added all three to its Known Exploited Vulnerabilities catalog. He has since disclosed additional Defender and Windows flaws roughly monthly.
BigDiskBuster watches the C: drive for new directories under Defender’s update paths. When Defender begins downloading a platform or definition update, the tool creates a hidden temporary file sized to fill all remaining free space, and the update fails.
Once the update fails and Defender removes its staging directory, the tool deletes the file and waits for the next attempt. It also opens a handle on MRT.exe, the Windows Malicious Software Removal Tool, in a way that would block Windows Update from replacing it.
Naceri describes the tool as “a bit buggy and needs some rewritting” and says it seems to work on all supported Windows versions. No independent researcher has confirmed the claimed behavior.
Naceri calls BigDiskBuster “similar to UnDefend,” a Defender denial-of-service flaw he disclosed in April that blocked definition updates through a different method. Microsoft patched it in May as CVE-2026-45498 in Antimalware Platform version 4.18.26040.7.
The two tools work differently. UnDefend used uncontrolled resource consumption, while BigDiskBuster fills the disk so Defender’s update directories cannot grow. Whether the May patch also covers this new technique is not established, and the different mechanism suggests it does not.
What Defenders Should Do
No patch or vendor workaround exists for BigDiskBuster.
Administrators can check that Defender’s signatures and platform version are current through Windows Security under Virus & threat protection, then Protection updates, then Check for updates. In PowerShell, Get-MpComputerStatus shows the current versions in the AMEngineVersion and AMProductVersion fields.
Monitoring for repeated Defender update failures, sustained low disk space on the system volume, and large hidden files in temporary directories would help detect the technique. Restricting execution of unknown binaries through WDAC or AppLocker would limit an attacker’s ability to run the tool.
