www.it-connect.fr
BigDiskBuster: New Zero-Day Prevents Microsoft Defender from Updating
A C: drive that suddenly fills up right at the moment Microsoft Defender tries to install an update. That is the idea behind BigDiskBuster, the new zero-day exploit published by Nightmare Eclipse. The result: the antivirus stays stuck on its current version. Here is what we know.
Nightmare Eclipse, whose real name is Abdelhamid Naceri, is not backing down. More importantly, this new disclosure confirms what he told me by email a few days ago: "I will not stop revealing security flaws. This is only the beginning." - That proved true last weekend, when he published a new proof-of-concept exploit on GitHub called BigDiskBuster. Its target is the one that keeps coming up in his work: Microsoft Defender. This time, though, there is no privilege escalation, because this is a denial-of-service attack designed to prevent Microsoft’s antivirus from updating (and therefore from getting fresh signatures).
"I made a fun tool; it completely prevents Defender from updating, so you stay stuck on your current version if the tool is running in the background," he wrote on X. According to him, BigDiskBuster works on all Windows versions.
The researcher describes it as similar to UnDefend, an exploit published last April (one of his first) that already allowed a standard user to block Defender definition updates. This is also a good reminder that the UnDefend flaw was exploited in real-world cyberattacks, alongside BlueHammer and RedSun.
As a reminder, since April 2026, Abdelhamid Naceri has published nearly a dozen Windows-targeting zero-day exploits, amid his conflict with Microsoft. Last week, I explained that Nightmare Eclipse had revealed his identity and described being fired from Microsoft. And the previous wave was only two weeks earlier: ShieldCrash, which bypasses the ShieldBreak fix to read any file with SYSTEM privileges, published just after September 2026 Patch Tuesday.
BigDiskBuster: Tricking Defender into Thinking the Drive Is Full
Microsoft Defender checks local storage space before updating itself. If the disk is full, the operation is canceled. BigDiskBuster is therefore designed to fool it. The exploit built by Nightmare Eclipse works like this:
- Monitoring: the tool watches the C: volume and waits for new folders to be created in
ProgramData\Microsoft\Windows Defender\PlatformandDefinition Updates, where Defender stores its updates. - Saturation: as soon as an update begins, it creates a hidden file in the user’s temporary folder, sized to consume all available disk space. The update fails because there is no room left.
- Cleanup: once the failure is detected, the space is released. The disk is only saturated briefly, which makes the behavior less noticeable.
My impression is that nothing in this code appears to require administrator privileges, so a standard user account may be enough.
On its own, BigDiskBuster does not allow a machine to be compromised. But Defender stuck on older signatures detects fewer recent threats, which can become a risk over time because it weakens protection.
This exploit is available on GitHub, but this flaw has no CVE reference and no patch either. For now, Microsoft has not responded. Perhaps it is one more issue to fix with the upcoming October 2026 Patch Tuesday...
