New Windows Defender Zero-Day Blocks Its Own Updates

A working proof-of-concept published on GitHub over the weekend, and confirmed by BleepingComputer within the last hour, starves Windows Defender of disk space until it can never finish a platform or signature update. It's called BigDiskBuster, it needs no admin rights, and as of this morning Microsoft has not shipped a fix, assigned a CVE, or said anything about it publicly.

The tool comes from a researcher who goes by Nightmare Eclipse on GitHub (handle: MSNightmare), publicly identified as Abdelhamid Naceri, a former Microsoft security contributor who has released nearly a dozen Windows zero-days since April in an open dispute over his own termination. BigDiskBuster is the latest entry, and it doesn't touch Defender's code at all. It just makes sure Defender can never find anywhere to write.

RelatedMicrosoft Patches RoguePlanet Defender Zero-Day

How does BigDiskBuster actually stop Defender from updating?

The mechanism is almost embarrassingly simple once you see it. Windows Defender's updater checks how much free disk space is available before it starts pulling a new platform build or signature package. BigDiskBuster watches for that update directory to appear, then races to claim the disk first: it creates a hidden, delete-on-close file in the user's own temp folder and asks Windows for essentially all of the remaining free space. Defender's updater looks for room, finds none, and the update silently stalls.

The clever part is what happens next. If Windows frees up space mid-update, say the updater deletes a partial download, or something else on the machine clears space, BigDiskBuster's worker threads notice and immediately grab the newly freed capacity again. It's not a one-shot trick; it's a standing siege on the disk that keeps Defender starved for as long as the tool keeps running in the background. Naceri describes the current build as "a bit buggy" and says it still needs rework, which tracks: this reads like a rough PoC, not a polished attack tool, but the underlying technique doesn't need much polish to work.

Why does this matter if it just blocks an update?

Because "just blocks an update" is exactly how a malware operator wants Defender to fail. A crashed or disabled antivirus is loud. Security software falling behind on signatures because of a disk-space quirk is quiet, deniable, and looks like an IT hygiene problem rather than an attack. Run BigDiskBuster in the background on a compromised endpoint and Defender keeps reporting itself as active and running, it just never gets the new detections that would catch whatever comes next. Naceri says it works on every currently supported version of Windows, and unlike some of his earlier releases, it does not require a standard user to already have elevated rights.

How does this compare to UnDefend, his last Defender exploit?

What has Microsoft actually said?

Nothing specific to this release as of publication. Microsoft has previously warned Naceri and researchers publishing similar tools about "malicious activity causing real harm" to customers, language that reads more like a legal warning than a security advisory. There's no Microsoft Security Response Center bulletin, no CVE reservation, and no acknowledgment that this is a recognized product flaw, which matters because a disk-space denial-of-service is the kind of bug that's easy for a vendor to wave off as "not a security boundary" even when it has a real security consequence. Naceri's own code is written in C++, sits in a public GitHub repo, and by his own description still needs cleanup, so treat it as a demonstrated technique rather than a turnkey attack kit for now. That gap rarely lasts.

RelatedMicrosoft's Record 966-Flaw Patch Tuesday Hits With 2 Zero-Days

Who should be paying attention right now?

Anyone running standard, unmanaged Windows Defender as their only line of defense, which is most consumer PCs and a meaningful slice of small business fleets that never turned on a third-party EDR product. Enterprise environments with centrally managed Defender for Endpoint and forced signature push are less exposed, since IT can monitor and enforce update compliance independently of what's happening on the local disk. If you administer a fleet, the practical move today is not waiting on a patch, it's watching Defender's signature version and last-update timestamp through Intune or your management console, the same way you'd watch for any endpoint that's gone quiet.

Our take

What's notable here isn't the code, it's the target. Naceri didn't attack Defender's detection engine or find a bypass in its scanning logic. He attacked the assumption underneath it: that an update process running on a healthy, unremarkable Windows machine will actually get the disk space it asks for. That's a much harder category of bug to close, because the fix isn't a signature update, it's rethinking how a critical security process claims resources on a system a local, unprivileged process can also touch. Microsoft's silence so far reads less like confidence and more like a company that still hasn't decided whether "your antivirus can be starved of disk space by anything else running locally" counts as a vulnerability worth a CVE. Given how much of Windows security now rests on Defender running quietly in the background, that's a question worth answering faster than a weekend release cycle usually forces.

Original analysis by GenZTech, based on BleepingComputer's report and the public GitHub proof-of-concept published September 2026. Read the source coverage.