A new proof-of-concept tool published on GitHub is stopping Microsoft Defender Antivirus from installing its own updates, and as of September 23, 2026, Microsoft has not issued a patch, a workaround, or even an advisory acknowledging the problem. The tool, called BigDiskBuster, was released on September 19 and reported the same weekend by The Hacker News and The Register. It arrived the same month SecurityWeek disclosed a separate Defender zero-day proof-of-concept, ShieldCrash, which reportedly targets fully patched Windows systems outright, underscoring that Defender’s update pipeline is drawing fire from more than one direction at once in September 2026. BigDiskBuster itself does not steal data, escalate privileges, or run remote code. Instead, it does something almost mundane: it fills up the hard drive at exactly the wrong moment, so Defender’s platform and signature updates have nowhere to land.
That simplicity is the story. A Microsoft defender zero-day that requires no memory corruption, no kernel driver, and no exotic tooling is arguably more dangerous in practice than a flashier bug, because almost any local user or piece of malware with basic file-write access can replicate it. Here is what is confirmed, what is still an open question, and what security teams should actually do about it.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What BigDiskBuster Actually Does
According to The Hacker News, BigDiskBuster is a local tool that runs quietly in the background and watches for filesystem activity tied to Microsoft Defender’s update directories, both the antivirus platform files and the security-intelligence (signature) definitions. The moment it detects Defender starting to download or install an update, it creates a hidden temporary file on the system drive, typically the C: volume, sized to consume nearly all of the remaining free disk space. With no room left to write, the update process fails, leaving an affected machine stuck on whatever build it had going in, such as the version 4.18.26080.4 platform release that Microsoft Learn lists as Defender’s current September 2026 update.
The Register’s writeup, headlined “NightmareEclipse’s latest zero-day leaves Microsoft Defender stuck in the past,” frames it the same way: a denial-of-service technique aimed squarely at keeping Defender’s protection engine and definitions frozen at whatever version was installed before the attack began. Security Affairs, which also covered the release, described it as triggering “a Denial of Service Vulnerability in Windows Defender Update.”
It is worth being precise about what this is not. BigDiskBuster does not disable the Defender service outright, does not grant code execution, and does not remove or bypass detections that are already installed. A machine hit by this technique keeps running whatever antivirus signatures it had before the attack, just permanently out of date. That is a narrower blast radius than a remote-code-execution flaw, but it is exactly the kind of gap that ransomware crews look for before dropping a payload built to evade last month’s signatures.
Who Is Behind the Exploit
The Hacker News identifies the author as Abdelhamid Naceri, a former Microsoft security researcher who has spent the past several years publicly releasing Windows and Defender-related proof-of-concept exploits. The Register refers to him by his online handle, NightmareEclipse, and other outlets covering the release, including Security Affairs, list additional aliases: Nightmare Eclipse, MSNightmare, INFINITE NIGHTMARE, and Chaotic Eclipse. The GitHub project itself is published under the account MSNightmare.
Naceri is not a newcomer to this particular fight. BleepingComputer’s report on the release notes that he called BigDiskBuster similar to an earlier tool of his, UnDefend, which surfaced in April 2026 and let a standard, non-administrator Windows user block Defender’s definition updates outright. The pattern across both releases is consistent: rather than trying to defeat Defender’s detection engine directly, Naceri keeps targeting the update pipeline that keeps that engine current.
How the Disk-Space Denial-of-Service Works, Step by Step
Based on the mechanism described by The Hacker News and corroborated by BleepingComputer, the attack chain is short:
- BigDiskBuster runs locally and persists in the background, watching for Defender-related filesystem activity.
- When Defender begins pulling a platform update or a new security-intelligence definition package, the tool detects the write activity.
- It immediately creates a hidden temporary file on the system drive, sized to consume nearly all remaining free space.
- Defender’s update process runs out of disk space mid-installation and fails to complete.
- The cycle can repeat on the next update attempt, keeping the machine’s Defender build and signatures pinned to an old version indefinitely.
Some coverage of the release, including reporting picked up by GBHackers, describes the current public build as somewhat unreliable, suggesting the proof-of-concept code may need further work before it behaves consistently across every environment. That caveat matters for defenders: a buggy PoC today does not mean a more polished, harder-to-detect version will not follow, especially given how quickly Naceri has iterated on prior Defender-focused releases.
No CVE, No Patch: Microsoft’s Silence So Far
As of this writing, no CVE identifier has been assigned to BigDiskBuster, and Microsoft has issued no advisory or workaround, according to both The Hacker News and The Register. That is a notable gap. A working, publicly posted denial-of-service technique against the update mechanism of the antivirus product built into every copy of Windows has been sitting on GitHub for four days without any acknowledgment from Redmond in the sources reviewed for this report.
That silence is not unusual for Naceri’s releases specifically. His April 2026 UnDefend tool followed a similar path: public disclosure first, official response later, if at all. What is different this time is the target. UnDefend interfered with the update process from a lower level. BigDiskBuster achieves a comparable outcome with a technique any developer could write in an afternoon, which raises the odds that variations of it start showing up bundled into commodity malware loaders rather than staying a niche research curiosity.
Which Windows Versions Are Affected
Naceri’s own project description reportedly claims the technique works against all currently supported versions of Windows running Microsoft Defender Antivirus. It is important to flag that this is the author’s claim, not an independently validated version matrix from Microsoft. No security bulletin currently confirms which builds, if any, are excluded, and no third-party lab has published its own reproduction results at the time of this report. Enterprise security teams should treat “all supported Windows versions” as the working assumption until Microsoft says otherwise, rather than as a confirmed fact.
BigDiskBuster vs UnDefend: A Pattern of Defender Bypasses
Put side by side, BigDiskBuster and UnDefend look like two attempts at the same goal by the same researcher, using different mechanisms. UnDefend, disclosed in April 2026, reportedly let a low-privilege standard user block Defender’s definition updates directly. BigDiskBuster, disclosed five months later, achieves a similar practical result, an antivirus engine frozen on stale signatures, but does it indirectly, through disk-space exhaustion rather than through interacting with Defender’s own permission model.
The table below lays out how the two techniques, plus one earlier Defender-adjacent flaw that Microsoft did patch, compare on mechanism, CVE status, and remediation.
| Technique | Disclosed | Target | Mechanism | CVE Assigned | Patch Status |
|---|---|---|---|---|---|
| BigDiskBuster | September 19, 2026 | Defender update pipeline | Disk-space exhaustion (local DoS) | None reported | No patch or advisory as of Sept. 23, 2026 |
| UnDefend | April 2026 | Defender definition updates | Standard-user update-blocking | Not confirmed in current reporting | No confirmed Microsoft fix reported |
| ShieldBreak (CVE-2026-69414) | Reported prior to patch | Malware Protection Engine | Local privilege escalation | CVE-2026-69414 | Patched by Microsoft, August 14, 2026 |
The contrast in the last row matters, and it got more complicated in September 2026. ShieldBreak, a Malware Protection Engine elevation-of-privilege flaw tracked as CVE-2026-69414, got a CVE number and a Microsoft patch on August 14, 2026, but The Hacker News reported that a separate SecurityWeek-disclosed proof-of-concept, ShieldCrash, reportedly bypassed that very patch the following month. BigDiskBuster and UnDefend, both attributed to the same researcher and both targeting the update process rather than the detection engine itself, remain without a CVE or fix at all. That split suggests Microsoft’s triage process is currently treating disk-space and permission-model issues around Defender updates differently than it treats flaws in the scanning engine proper, even though the practical security outcome, an antivirus product running on outdated or circumvented signatures, looks similar from a defender’s chair.
Timeline: How the Story Broke
Coverage of BigDiskBuster moved fast once the GitHub repository went public. Here is the sequence based on publication dates and datelines from the outlets that reported it.
| Date | Event | Source |
|---|---|---|
| September 19, 2026 | BigDiskBuster proof-of-concept published on GitHub under account MSNightmare | The Hacker News |
| September 21, 2026 | Technique picked up and described as a local denial-of-service issue | GBHackers |
| September 22, 2026 | “Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates” published | The Hacker News |
| September 22, 2026 | “NightmareEclipse’s latest zero-day leaves Microsoft Defender stuck in the past” published | The Register |
| September 22, 2026 | Report ties BigDiskBuster to Naceri’s earlier UnDefend release | BleepingComputer |
| September 22-23, 2026 | Additional coverage confirms no CVE and no Microsoft advisory | Security Affairs |
Four days from a GitHub commit to coverage in two of the security industry’s most-read outlets is fast, but not unusual for a researcher with Naceri’s track record. What is unusual is how little has changed on Microsoft’s side of the ledger in that window.
Why Disk-Space Exhaustion Attacks Are Hard to Patch Cleanly
Part of what makes BigDiskBuster awkward for Microsoft is that the underlying primitive, filling a disk with a large file, is not itself a vulnerability. Any local process with write access to the system drive can do that. The actual weakness is narrower: Defender’s update routine apparently has no reserved buffer or fallback behavior for the specific case where free space evaporates at the exact moment it needs to write. Fixing that means changing how the update process reserves space or detects and reports the failure, not closing a single code-level bug the way a memory-safety patch would.
That is a harder problem to test and ship quickly, and it may explain part of the delay in an official response. It does not, however, explain the complete absence of even an acknowledgment, which is the detail multiple outlets flagged as notable in their coverage of the release.
Market and Industry Impact
Microsoft Defender Antivirus ships by default on every modern Windows installation, which makes it, by sheer footprint, one of the most widely deployed security products on the planet. A silent, low-skill technique for freezing its updates does not need to be sophisticated to matter at scale. It needs to be cheap to deploy and hard to notice, and disk-space exhaustion checks both boxes for attackers who already have a foothold on a machine, whether through a phishing payload, a compromised script, or an insider with local access.
For managed security service providers and enterprise SOC teams, the immediate concern is less about a single machine getting hit and more about detection blind spots. A Defender install that silently stops updating does not necessarily throw a loud alarm the way a disabled antivirus service would. Endpoint detection platforms that alert on Defender being turned off may miss a machine that is technically still “on” but running weeks-old signatures. That gap is exactly the kind of scenario ransomware operators have exploited before, pairing an unpatched or under-monitored endpoint with malware built to slip past whatever detections were current a month earlier.
The timing also lands during a period of unusually heavy scrutiny on Microsoft’s patch cadence. The company’s own September 2026 Patch Tuesday closed out at a record 966 vulnerabilities, including roughly 20 rated wormable. A publicly posted, unpatched Defender-update bypass surfacing in the same month adds to a narrative security teams are already tracking closely: patch volume at Microsoft is climbing even as specific, narrowly scoped issues like BigDiskBuster sit unaddressed for days.
Historical Context: A Long Line of Antivirus Update Bypass Techniques
Attacking the update mechanism rather than the detection engine is not a new idea in security research. Malware families have used everything from hosts-file tampering to block signature-server domains, to service-permission abuse that disables the Windows Update Orchestrator for specific components, to registry manipulation that throttles how often Defender checks in for new definitions. What sets Naceri’s recent work apart, first with UnDefend and now with BigDiskBuster, is that both techniques were published openly as proof-of-concept research rather than discovered after the fact inside live malware samples.
That openness cuts both ways. It gives defenders early warning and, eventually, pressure on Microsoft to respond. It also hands a ready-made blueprint to anyone building a malware loader who was not already thinking about disk-space exhaustion as an evasion primitive. Public proof-of-concept releases for Windows security-relevant bugs have historically triggered a scramble on both sides: red teams and penetration testers adopting the technique for legitimate engagements within days, and less scrupulous actors doing the same for less legitimate ones.
How BigDiskBuster Fits Into 2026’s Broader Zero-Day Pattern
2026 has been a heavy year for zero-day and near-zero-day disclosures across major vendors. Cisco patched a perfect-10 CVSS zero-day in its Identity Services Engine alongside nine other bugs earlier this year. A Linux kernel flaw nicknamed ZcopyReaper hit CVSS 7.8 after sitting unnoticed since 2018. CISA has spent much of the year pushing agencies to patch actively exploited bugs in products from WatchGuard Firebox and VMware vCenter, both of which ended up on ransomware groups’ target lists soon after disclosure.
BigDiskBuster is a smaller-scale story than any of those in terms of raw severity, since it requires local access and does not enable remote compromise on its own. But it fits the same pattern that has defined 2026’s threat landscape: researchers and threat actors increasingly targeting the update and patch-delivery mechanisms of security products themselves, rather than trying to out-engineer the detection logic directly. If an attacker can keep a target’s defenses running on stale signatures, the actual malware payload barely needs to be sophisticated at all.
What IT Admins and Security Teams Can Do Right Now
With no official Microsoft patch or advisory to point to, defensive options are limited to general hardening rather than a targeted fix. Based on how the technique is described in current reporting, a few practical steps reduce exposure:
- Monitor free disk space on endpoints and servers with alerting thresholds well above zero, since a sudden, sharp drop in available space is the core signal of this technique.
- Check Defender’s last successful platform and definition update timestamp across the fleet rather than assuming “service running” equals “signatures current.”
- Restrict local write access to system drives where feasible, particularly on shared or kiosk-style machines with multiple standard-user accounts.
- Treat any endpoint detection and response alert about disk capacity alongside antivirus health checks, not as a separate, lower-priority ticket queue.
- Track Microsoft’s security response center for an eventual advisory, since neither The Hacker News nor The Register reported one as of publication.
None of this is a substitute for an actual vendor patch. It is a stopgap for the period, now four days and counting, during which the technique is public and Microsoft’s response is not.
Predictions: Where This Story Goes Next
A few things look likely to happen over the coming weeks based on how similar disclosures have played out this year:
- Microsoft eventually issues some form of guidance or a Defender update-reliability fix, most plausibly bundled into a future monthly update rather than an emergency out-of-band patch, given the local-access requirement limits urgency from Redmond’s perspective.
- A CVE identifier gets assigned once Microsoft’s security response team completes triage, following the same delayed pattern seen with several of Naceri’s past releases.
- Security vendors and endpoint detection platforms add specific detection rules for the disk-fill-plus-Defender-update pattern well before Microsoft ships a native fix, since that kind of behavioral signature is straightforward to build.
- Naceri, or another researcher following the same research thread, publishes a refined or alternate version of the technique, consistent with the iterative pattern between UnDefend and BigDiskBuster.
- Expect renewed debate over Microsoft’s response time to independently disclosed, non-CVSS-critical Defender issues, especially given the contrast with the swifter patch timeline for ShieldBreak.
The Bigger Picture for Windows Security
BigDiskBuster is not going to headline a ransomware breach report on its own. What it does is illustrate a soft spot in how Windows’ built-in defenses stay current: the update pipeline itself is a target, and it does not take a sophisticated exploit to knock it offline. For a security product installed by default on hundreds of millions of machines, that is a meaningful gap regardless of how it is scored on a severity chart.
Until Microsoft responds, the practical advice is unglamorous: watch disk space, check update timestamps, and do not assume a running Defender process means a current one.
Frequently Asked Questions
What is BigDiskBuster?
BigDiskBuster is a proof-of-concept tool, published on GitHub on September 19, 2026, that prevents Microsoft Defender Antivirus from completing platform and security-intelligence updates by filling available disk space at the moment an update begins, according to The Hacker News.
Who created BigDiskBuster?
The Hacker News attributes it to Abdelhamid Naceri, a former Microsoft security researcher also known online as Nightmare Eclipse, NightmareEclipse, MSNightmare, and Chaotic Eclipse.
Has Microsoft assigned a CVE or released a patch?
No. As of September 23, 2026, both The Hacker News and The Register report no CVE identifier, no patch, and no official Microsoft advisory addressing BigDiskBuster.
Which Windows versions are affected?
The author claims the technique works on all currently supported Windows versions running Defender Antivirus, but this has not been independently confirmed by Microsoft or verified against a specific build list in current reporting.
Does BigDiskBuster allow remote code execution or data theft?
No. Based on the mechanism described by The Hacker News and BleepingComputer, it is a local denial-of-service technique against the update process. It does not grant code execution, escalate privileges, or bypass already-installed detections.
How is BigDiskBuster related to UnDefend?
BleepingComputer reports that Naceri described BigDiskBuster as similar to UnDefend, an April 2026 tool he released that let a standard Windows user block Defender’s definition updates through a different mechanism.
Can antivirus or endpoint detection tools catch this technique?
Current reporting does not confirm specific detection signatures from major endpoint security vendors. Monitoring disk space thresholds and Defender’s last successful update timestamp are reasonable interim steps while dedicated detections are developed.
Is this the same issue as ShieldBreak?
No. ShieldBreak, tracked as CVE-2026-69414, was a separate Malware Protection Engine privilege-escalation flaw that Microsoft patched on August 14, 2026. It targeted a different component and used a different mechanism than BigDiskBuster’s disk-exhaustion approach, though The Hacker News reported in September 2026 that a SecurityWeek-disclosed proof-of-concept called ShieldCrash reportedly bypassed that same patch, adding another unresolved thread to Defender’s update and patch story this month.
