Security researcher Abdelhamid Naceri published a proof-of-concept tool called BigDiskBuster on GitHub on September 19, 2026, that prevents Microsoft Defender from installing platform and signature updates by consuming available disk space.
As of September 22, Microsoft has issued no patch, assigned no CVE identifier, and released no advisory addressing the zero-day. Naceri, a former Microsoft security researcher known by the handle “NightmareEclipse,” has a track record of Defender exploits that later appeared in real-world attacks.
BigDiskBuster Proof-of-Concept Published September 19 on GitHub
Naceri released the BigDiskBuster tool on GitHub on September 19, 2026. The proof-of-concept fills available disk space on the target system, preventing Microsoft Defender from downloading and installing platform or signature updates.
Microsoft Defender requires free disk space to download update packages, decompress them, and apply the new platform binaries or malware signature databases. When available disk space falls below the threshold required for update operations, Defender fails to install updates but continues running with outdated components.
Attack Leaves Defender Running with Outdated Signatures and Platform
BigDiskBuster does not disable Microsoft Defender or terminate its processes. Instead, the tool leaves Defender active but unable to update, resulting in a system protected by outdated malware signatures and an outdated platform version.
This state is operationally worse than a disabled antivirus in some respects. Users and administrators see Defender running and may assume the system is protected, unaware that the signature database has not received updates for days or weeks. The system remains vulnerable to malware and exploits released after the last successful Defender update.
The attack also evades detection mechanisms that flag disabled security products. Many endpoint management tools and security monitoring systems alert when antivirus software is turned off but do not trigger alerts when an antivirus is running but unable to update.
Naceri’s Prior Defender Exploits Used in Real-World Attacks
Abdelhamid Naceri previously disclosed Defender vulnerabilities that threat actors later incorporated into real-world attack campaigns. The precedent raises concern that BigDiskBuster, now publicly available on GitHub, could be integrated into malware or pre-ransomware toolkits to neutralize Defender protection before deploying payloads.
Naceri left Microsoft and now publishes proof-of-concept exploits independently. His prior work demonstrated privilege escalation flaws, security bypass techniques, and sandbox escape vulnerabilities in Windows and Defender components.
No Microsoft Patch or Advisory as of September 22
Microsoft has not released a patch for the BigDiskBuster technique as of September 22, 2026. The company has also not assigned a CVE identifier or published a security advisory acknowledging the issue.
The absence of a CVE assignment may indicate Microsoft does not classify the disk-filling technique as a traditional vulnerability. Consuming disk space is not a code-level flaw but an operational denial-of-service condition that can be created through various means, not all of which Microsoft may consider remediable through software patches.
However, the practical impact remains: an attacker with local code execution can prevent Defender from updating, leaving the system unprotected against newer threats. Organizations relying on Defender as their primary endpoint protection face a gap between detection and response when the signature database falls out of date.
Implications for Defender Update Integrity and Tamper Protection
BigDiskBuster exposes a design limitation in how Defender handles update failures caused by resource exhaustion. The tool does not exploit a memory corruption bug or authentication bypass—it simply fills disk space, a condition Defender does not appear to defend against or alert on effectively.
Tamper protection mechanisms in Defender focus on preventing malicious code from terminating Defender processes, modifying registry settings, or deleting signature files. These protections do not address scenarios where an attacker prevents updates indirectly by making the system environment unsuitable for update operations.
Organizations running Microsoft Defender should monitor disk space consumption patterns on endpoints, configure alerts for systems with critically low free disk space, and investigate any sudden disk usage spikes that could indicate an attack designed to prevent security updates. Endpoint management tools should flag systems where Defender has not successfully updated within a defined threshold, such as 48 or 72 hours.
The publication of BigDiskBuster on GitHub makes the technique accessible to any threat actor. Organizations cannot rely on Microsoft to patch the issue in the short term and must implement monitoring and response procedures to detect and remediate systems where Defender update failures occur due to artificial disk exhaustion.
Naceri’s decision to publish the proof-of-concept without coordination with Microsoft follows a pattern seen in his prior disclosures. The immediate availability of working exploit code increases the urgency for organizations to implement compensating controls while waiting for Microsoft to address the underlying issue.
