Full Report
A zero-day proof-of-concept tool that stops Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE, and no Microsoft advisory. Its author, Abdelhamid Naceri, is a former Microsoft security researcher whose earlier Defender exploits were used in
Analysis Summary
# Vulnerability: BigDiskBuster Zero-Day (Microsoft Defender Update Denial of Service)
## CVE Details
- **CVE ID:** N/A (Zero-day; no CVE assigned at the time of reporting)
- **CVSS Score:** N/A (Estimated Medium/High based on impact to endpoint protection)
- **CWE:** CWE-400 (Uncontrolled Resource Consumption) / CWE-770 (Allocation of Resources Without Limits or Throttling)
## Affected Systems
- **Products:** Microsoft Defender Antivirus, Windows Malicious Software Removal Tool (MRT.exe)
- **Versions:** Reported to work on all supported Windows versions.
- **Configurations:** Systems relying on Microsoft Defender for endpoint protection and signature-based detection.
## Vulnerability Description
BigDiskBuster is a proof-of-concept (PoC) tool that induces a Denial of Service (DoS) condition on Microsoft Defender's update mechanism. The tool monitors the system for new directories under Defender’s update paths (typically on the `C:\` drive). When an update attempt is detected, the tool creates a hidden temporary file sized to occupy all remaining disk space. This prevents the update staging directory from growing, causing the platform or signature update to fail. Additionally, the tool opens a handle on `MRT.exe` to prevent Windows Update from replacing or updating the Malicious Software Removal Tool.
## Exploitation
- **Status:** PoC available (Published on GitHub on September 19, 2026). Previous similar tools by the same author have been exploited in the wild.
- **Complexity:** Low (Automated tool available).
- **Attack Vector:** Local (Requires the ability to execute a binary on the target host).
## Impact
- **Confidentiality:** None
- **Integrity:** Medium (Security signatures become stale, potentially allowing undetected malware infections).
- **Availability:** High (Disables the update functionality of the primary system antivirus and the Malicious Software Removal Tool).
## Remediation
### Patches
- **None:** There is currently no official Microsoft patch or advisory for this specific vulnerability.
### Workarounds
- **Application Whitelisting:** Use Windows Defender Application Control (WDAC) or AppLocker to prevent the execution of unauthorized or unknown binaries like the BigDiskBuster tool.
- **Manual Verification:** Administrators should manually verify update status via Windows Security (Virus & threat protection > Protection updates) or via PowerShell using `Get-MpComputerStatus`.
## Detection
- **Indicators of Compromise (IoCs):**
- Large, hidden temporary files appearing and disappearing on the system volume (`C:\`).
- Sudden, temporary drops in available disk space to 0 KB.
- Repeated "Generic Windows Error" notifications during Defender update attempts.
- **Detection Methods:**
- Monitor for sustained low disk space alerts on the system drive.
- Audit process activity for unexpected handles opened on `MRT.exe`.
- Check PowerShell `AMEngineVersion` and `AMProductVersion` for out-of-date signatures.
## References
- **GitHub Repository:** hxxps[://]github[.]com/MSNightmare/BigDiskBuster
- **Related Vulnerability (UnDefend):** hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2026-45498
- **Original Report:** hxxps[://]thehackernews[.]com/2026/09/researcher-drops-bigdiskbuster-zero-day.html