Full Report
BigDiskBuster leaves Microsoft's antivirus running but unable to install updates
Analysis Summary
# Vulnerability: BigDiskBuster (Defender Update Denial of Service)
## CVE Details
- **CVE ID**: N/A (Currently tracked as a Zero-Day; no CVE assigned by Microsoft at time of reporting)
- **CVSS Score**: Estimated 4.0 - 5.5 (Medium)
- **CWE**: CWE-400: Uncontrolled Resource Consumption
## Affected Systems
- **Products**: Microsoft Defender Antivirus
- **Versions**: Claimed to affect all supported versions of Windows (Windows 10, Windows 11, Windows Server).
- **Configurations**: Any system relying on Microsoft Defender for real-time protection and security intelligence updates.
## Vulnerability Description
BigDiskBuster is a resource exhaustion flaw that targets the update mechanism of Microsoft Defender. Unlike traditional exploits that disable the service, this method monitors for the initiation of a Defender update process. Once an update is detected, the tool programmatically creates hidden temporary files to consume all available disk space, causing the update to fail due to insufficient storage. Additionally, the tool opens a handle to the Malicious Software Removal Tool (`MRT.exe`) with restrictive sharing permissions, further interfering with diagnostic and remediation processes.
## Exploitation
- **Status**: PoC available (Released by researcher NightmareEclipse/Abdelhamid Naceri).
- **Complexity**: Low (Automated via PoC script).
- **Attack Vector**: Local (Requires the ability to run code/background processes on the target machine).
## Impact
- **Confidentiality**: None.
- **Integrity**: Low (Prevents the system from receiving the latest integrity checks/signatures).
- **Availability**: Medium (Directly impacts the availability of the update service, leaving the system vulnerable to new threats).
## Remediation
### Patches
- **No official patch currently available.** Microsoft has not yet released a security update specifically addressing this logic flaw.
### Workarounds
- **Disk Quotas**: Implementing strict disk quotas for non-privileged users may limit the tool's ability to exhaust system-wide free space.
- **Alternative Security Layers**: Use of third-party EDR or AV solutions that do not rely on the Windows Update/Defender intelligence pipeline.
- **Monitoring**: Establish alerts for frequent `0x80070643` errors in Windows Update logs combined with sudden, temporary drops in disk space.
## Detection
- **Indicators of Compromise**:
- Presence of the `BigDiskBuster` executable or similar background processes.
- Windows Security error code `0x80070643` during definition updates.
- Rapid, unexplained fluctuations in free disk space during update cycles.
- **Detection Methods**:
- Monitor for processes holding long-standing, exclusive handles to `MRT.exe`.
- Use File Integrity Monitoring (FIM) to detect the creation of large, hidden temporary files in system directories.
## References
- **Researcher PoC**: hxxps[://]github[.]com/MSNightmare/BigDiskBuster
- **Researcher Socials**: hxxps[://]x[.]com/MSNightmare2000/status/2101461664008675385
- **News Source**: The Register Article (September 2026)