"a bit buggy and needs some rewritting," wrote Abdelhamid Naceri of his new proof-of-concept tool, BigDiskBuster, which he published to GitHub on September 19.
Abdelhamid Naceri releases BigDiskBuster
BigDiskBuster is a zero-day proof-of-concept (PoC) tool that, according to its author, prevents Microsoft Defender from installing platform and signature updates by filling all available disk space. At the time of publication there is no patch, no CVE, and no Microsoft advisory for the tool. Naceri, a former Microsoft security researcher who says he was dismissed from Microsoft's Security Response Center in 2024, has been releasing exploits without coordinating with the company since April.
How BigDiskBuster works, as described by its author
According to the PoC, BigDiskBuster watches the C:\ drive for new directories created under Defender's update paths. When Defender begins downloading a platform or definition update, the tool creates a hidden temporary file sized to fill the remaining free space. That exhaustion of free space causes the update to fail; after the failed update and when Defender removes its staging directory, the tool deletes the file and waits for the next update attempt. The PoC also opens a handle on MRT.exe (the Windows Malicious Software Removal Tool) in a way that would block Windows Update from replacing that file.
The author says the tool "seems to work on all supported Windows versions" but calls it "a bit buggy and needs some rewritting." The published PoC includes a screenshot of Defender returning a generic Windows error when trying to update; the materials do not establish whether that failure raises any automatic alert within Defender.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildContext: prior Defender exploits and the May patch
Naceri's earlier Defender-focused tools — BlueHammer, RedSun, and UnDefend — were reportedly exploited in live intrusions before Microsoft patched the issues and the Cybersecurity and Infrastructure Security Agency (CISA) added all three to its Known Exploited Vulnerabilities catalog. UnDefend, disclosed by Naceri in April, blocked definition updates through a different uncontrolled-resource-consumption method; Microsoft patched UnDefend in May as CVE-2026-45498 in Antimalware Platform version 4.18.26040.7.
BigDiskBuster uses a different mechanism — filling the disk so Defender's update directories cannot grow — and whether the May patch covers this new technique is not established. The difference in method suggests it may not be covered by that earlier fix.
Detection and practical steps for defenders
There is no vendor-provided workaround or patch for BigDiskBuster in the published material. The guidance the PoC offers for administrators is concrete and narrow:
- Verify Defender signatures and platform version via Windows Security: open Virus & threat protection, select Protection updates, and choose Check for updates.
- In PowerShell, run Get-MpComputerStatus and inspect the AMEngineVersion and AMProductVersion fields to confirm current versions.
- Monitor for telltale operational signs: repeated Defender update failures, sustained low disk space on the system volume, and large hidden files in temporary directories that might be sized to exhaust free space.
- Restrict execution of unknown binaries using Windows Defender Application Control (WDAC) or AppLocker to limit an attacker's ability to run such a tool.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Track Defender update success and the AMEngineVersion/AMProductVersion fields, look for persistent low-free-space conditions, and add checks for unusually large hidden temporary files in Defender update paths.
- Enterprises and procurement leaders: Note that no patch or CVE is public for BigDiskBuster; maintain controls that restrict execution of unvetted binaries (WDAC/AppLocker) and ensure monitoring for repeated update failures and disk-space anomalies is in place.
- End users: Use Windows Security to confirm signatures and platform versions are current; report repeated protection-update failures to administrators, who may need to investigate system-volume space and temporary files.
BigDiskBuster arrives with a clear provenance: its author has previously disclosed Defender and Windows flaws that were later exploited in the wild and patched. The current PoC shows a simple operational method — fill the disk at the moment of download — that leaves Defender running but with stale detection content if updates cannot be applied. Crucial questions remain unanswered by the published material, most notably whether Microsoft's May patch for UnDefend covers this new technique; the disclosure itself notes that the different mechanism suggests it does not. Administrators and defenders are left with monitoring and execution controls as the only specified defenses until a vendor advisory, CVE, or patch appears.
Original story: Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
