BigDiskBuster: The Zero-Day That Leaves Microsoft Defender Stuck…

Researcher NightmareEclipse has released BigDiskBuster, a proof-of-concept that blocks Microsoft Defender updates by saturating disk space. No patch is available.

NightmareEclipse, the security researcher known as Abdelhamid Naceri, published a proof-of-concept dubbed BigDiskBuster on GitHub on September 19, 2026. The tool does not disable Microsoft Defender; instead, it systematically blocks its updates, leaving the antivirus running with outdated security and platform definitions. The technique constitutes a denial-of-service attack against an EDR's update infrastructure, carrying a high risk profile because three previous exploits from the same author landed in the CISA Known Exploited Vulnerabilities catalog before patches were available.

Key Takeaways

The BigDiskBuster PoC, released September 19, 2026, blocks Microsoft Defender updates by consuming all available disk space during the download process.
The tool opens and holds a lock on MRT.exe (Malicious Software Removal Tool), preventing parallel updates by other processes.
Microsoft Defender remains operational but with obsolete definitions, a condition that exposes systems to threats the antivirus engine no longer recognizes.
No patch, CVE, or Microsoft advisory exists for BigDiskBuster at this time; the company has not responded to requests for comment.

The Mechanism: A Race Condition on Free Space

BigDiskBuster exploits a race condition in Microsoft Defender's update architecture. According to technical details reconstructed by The Register, the tool continuously monitors the antivirus's update paths. When it detects the start of a definition download or platform update, it rapidly creates hidden temporary files sized to consume all available disk space.

The update installation fails due to insufficient disk space. At that point, BigDiskBuster closes the temporary files and returns the space, leaving the system in an apparently normal state but with Defender stuck on the version prior to the attempt. The cycle repeats with every subsequent update attempt.

The Hacker News confirms a second mechanism: the tool opens the MRT.exe executable to maintain an active handle that restricts access by other processes. This lock blocks parallel update attempts, closing a potential workaround.

NightmareEclipse's Signature: From Ex-Microsoft to Open Feud

Abdelhamid Naceri, alias NightmareEclipse, has stated he was fired from the Microsoft Security Response Center in 2024. Since April 2026, he has been publicly releasing zero-days without coordinating disclosure with the company, in a sequence that has surpassed a dozen proof-of-concepts according to BleepingComputer estimates.

The context is not merely biographical: three previous Naceri exploits — BlueHammer, RedSun, and UnDefend — were exploited in real intrusions before Microsoft released the corresponding patches. All three were added to the CISA Known Exploited Vulnerabilities catalog, documenting an effective transition from research to weaponization in the wild.

BigDiskBuster falls into this lineage but with a significant mechanical difference. UnDefend, the most directly comparable exploit, also blocked Defender updates. BigDiskBuster refines the technique by introducing dynamic disk saturation and the MRT.exe lock, making the mechanism harder to interrupt without explicitly terminating the malicious process.

"Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background" — NightmareEclipse (Abdelhamid Naceri), quoted by The Register

A Working but Toothless Antivirus: The Risk Paradox

The technical condition created by BigDiskBuster presents an insidious risk profile precisely because it does not violate the antivirus's integrity. Defender continues to run scans, intercept known executables, and keep real-time protections active. But the security definitions — the signature database that recognizes malware, infostealers, and ransomware — stop updating.

In a rapidly evolving threat landscape, obsolete definitions degrade effective protection exponentially. A ransomware sample released on September 20, 2026 would not be recognized by a Defender with a database frozen at September 18. The user or system administrator would receive no alert beyond the standard update failures, easily attributed to temporary network issues.

The Hacker News explicitly reports that BigDiskBuster "has no patch, no CVE, and no Microsoft advisory." This absence of official recognition also prevents the activation of automated controls based on indicators of compromise or specific detection rules.

Immediate Actions

Monitor Microsoft Defender update logs. Repeated failures to install security definitions, especially if accompanied by sudden fluctuations in available disk space, warrant immediate investigation.

Check for MRT.exe processes with open handles from unauthorized applications. The MRT.exe lock by BigDiskBuster is a specific behavioral indicator of the tool.

Implement disk-space monitoring with early-warning thresholds. The rapid saturation and subsequent release of space constitutes an anomalous pattern detectable with properly configured monitoring tools.

Evaluate complementary protection layers not dependent on Defender definitions. The reduced efficacy of the antivirus with an obsolete database necessitates alternative countermeasures for detecting evolving threats.

Microsoft's Silence and the Limits of the Case

Microsoft has not responded to requests for comment on BigDiskBuster. This silence, combined with the absence of a CVE and advisory, leaves open questions about the timeline for a possible official response. The historical profile of Naceri's exploits — inclusion in the CISA KEV catalog and exploitation in the wild — makes it imprudent, however, to treat BigDiskBuster as a mere theoretical demonstration.

Some of the author's claims remain unverified, particularly universal compatibility with all supported Windows versions. Naceri has stated it "seems to work on all supported Windows versions" but admitted the PoC is "a bit buggy and needs rewriting." The security community has not yet published independent tests across different OS versions.

Equally unknown is the behavior on systems with particularly large disk space or quota policies that could interfere with the saturation mechanism. The dossier does not specify whether BigDiskBuster has already been detected in real-world attacks, nor whether third-party EDR tools can identify or block its execution.

Why This Technique Worries the Industry

BigDiskBuster is not a privilege bypass or a local escalation: it is an attack on update availability, a denial-of-service vector applied to the security infrastructure itself. This modality is potentially portable to other vendors that implement similar update mechanisms, with temporary files downloaded to predictable paths and space checks performed at non-atomic moments relative to installation.

For organizations, the implication is twofold. First, trust in automatic updates as a survival mechanism for EDR must be supplemented with active verification of definition status, not passively assumed. Second, the Naceri sequence demonstrates that a breakdown in coordination between researcher and vendor can produce exposure windows measured in weeks or months, not days.

The history of BlueHammer, RedSun, and UnDefend in the CISA KEV catalog does not guarantee BigDiskBuster will follow the same path, but it documents that the jump from proof-of-concept to in-the-wild exploit has occurred three consecutive times with the same author. This precedent transforms the risk from speculative to historically grounded.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter