BigDiskBuster (published 2026-09-21 at github.com/MSNightmare/BigDiskBuster, MIT license, 3 commits, 165 stars/26 forks at time of review) is a Windows Defender Update Denial-of-Service proof-of-concept authored by the researcher publicly identified as Abdelhamid Naceri, operating under the handles Chaotic Eclipse, Nightmare Eclipse, MSNightmare, and INFINITE NIGHTMARE. The tool's README describes it as 'similar to UnDefend' (Naceri's April 2026 Defender PoC that let a standard user block definition updates) and states it 'prevents windows defender from performing platform/signature updates.'

Exploit chain / mechanics, per the released C++ source (BigDiskBuster.cpp): the tool registers a change-notification watch (ReadDirectoryChangesW, with FILE_NOTIFY_CHANGE_FILE_NAME / FILE_NOTIFY_CHANGE_DIR_NAME / FILE_NOTIFY_CHANGE_SIZE flags, processed asynchronously via GetOverlappedResult) on Windows Defender's Platform and Definition Updates directories under C:\ProgramData\Microsoft\Windows Defender\ -- i.e. it fingerprints Defender's own update behavior (a security-software-discovery step) to know when to strike, rather than running continuously at full intensity. When update activity is observed, it queries available free capacity on the system volume via the low-level native API NtQueryVolumeInformationFile (a system/disk-information-discovery step, called directly rather than through the higher-level Win32 GetDiskFreeSpaceEx wrapper) and then spawns worker threads (CreateThread / WaitForSingleObject) that open files via NtCreateFile in the user's %TEMP% directory with FILE_ATTRIBUTE_HIDDEN set and the FILE_DELETE_ON_CLOSE creation flag (reinforced with SetFileInformationByHandle using FILE_DISPOSITION_FLAG_DELETE / FILE_DISPOSITION_FLAG_POSIX_SEMANTICS), sized to consume the remaining free space; file/folder names for these temp objects are generated with CoCreateGuid / StringFromGUID2 / CLSIDFromString, producing GUID-formatted names that resemble legitimate Windows-generated temporary artifacts rather than an obviously attacker-authored filename. If the update process frees space by unpacking/removing files, the worker threads immediately reclaim the newly freed capacity via the same mechanism, starving the update of the disk headroom it needs. Because the temp files carry the delete-on-close disposition, they are automatically removed by the OS the moment their handles are closed, leaving little forensic trace once the tool exits or releases them -- the PoC releases its handles and frees the consumed space once the monitored update directory stops showing activity (interpreted as a failed update attempt). In parallel, the tool opens a handle on the Malicious Software Removal Tool binary (C:\Windows\System32\MRT.exe) with a restrictive combination of sharing flags (omitting FILE_SHARE_WRITE/FILE_SHARE_DELETE on at least one open handle), blocking other processes -- including the updater -- from replacing or modifying that file. Together these primitives cause Defender's three update streams -- security intelligence (malware signatures), engine updates, and platform updates -- to fail, while the Defender/AV service itself continues to report as running, masking the degraded protection state from casual observation. The author's own description of the tool: 'Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background' -- confirming the DoS requires the process to remain resident; no autostart/persistence mechanism is described. Observed failure indicators reported by independent analysis include Windows error code 0x80070643 ('Protection definition update failed') and the absence of the normally-recorded Event ID 2000 (successful signature update) under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

The author states the PoC 'seems to work on all supported windows versions but ... is a bit buggy and needs some rewritting.' No independent verification of cross-version compatibility was found in available reporting, and no CVE identifier or Microsoft security advisory has been issued as of 2026-09-22. Exploitation requires local code execution (an adversary or insider already has access to run an arbitrary binary on the target); it is not a remote or network-facing vector, and no privilege escalation is required beyond running the binary in a session with write access to %TEMP%. One risk-scoring aggregator (Rankiteo) independently rated the disclosure 85/100 severity with an impact rating of 4; this is a third-party heuristic score, not a CVSS vector, and this record's own severity_level is set independently per the absence of a vendor CVSS score.

Attribution / context: BigDiskBuster is the latest in a string of roughly a dozen zero-day/PoC releases Naceri has published since roughly April 2026, spanning Microsoft Defender and BitLocker (UnDefend, BigDiskBuster, RoguePlanet, ShieldCrash, RedSun, LegacyHive, BlueHammer, YellowKey, GreenPlasma, MiniPlasma), Nvidia (GreenSection, memory corruption), Kaspersky Endpoint Security (HardBreacher, privilege escalation), Avast/GenDigital Antivirus (PrettyPrague, privilege escalation), and CrowdStrike Falcon (FalconFlank, a privilege-escalation PoC reported to abuse Falcon's own macro-removal feature). Of particular note is RoguePlanet (CVE-2026-50656), released 2026-06-10 -- hours after that month's Patch Tuesday -- a separate local-privilege-escalation PoC that abuses a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Microsoft Defender's file-processing path (MsMpEng.exe validates a file path, then the attacker swaps the target via an NTFS reparse point/junction/symbolic-link redirection before the write completes) to obtain SYSTEM-level code execution on fully patched Windows 10/11; the researcher reported inconsistent reliability ('100% success rate on some machines while it struggled to work on others'). Microsoft patched RoguePlanet on 2026-07-09 via an out-of-band Malware Protection Engine update (version 1.1.26060.3008) rather than the standard Patch Tuesday cadence. RoguePlanet is a distinct vulnerability and exploit chain from BigDiskBuster (privilege escalation via race condition vs. local resource-exhaustion DoS) and its MITRE ATT&CK mapping is NOT carried into this record's technique list, which is scoped to BigDiskBuster's own observed mechanism. Two weeks before BigDiskBuster, on 2026-09-09, Naceri also released ShieldCrash, a PoC that triggers an arbitrary SYSTEM-level file read in the Malware Protection Engine by exploiting a gap in Microsoft's September 2026 patch (engine version 1.1.26080.3) for CVE-2026-69414 (ShieldBreak) -- again a distinct vulnerability/PoC from BigDiskBuster, part of the same disclosure campaign against Microsoft security products. Naceri publicly disclosed his identity roughly one week before releasing BigDiskBuster (2026-09-14), stating he previously worked for Microsoft in the UK and Germany, was terminated in March 2025 'abruptly and without a clear justification,' was offered and rejected multiple financial settlement options, sought a formal explanation and help remaining in Germany, and ultimately lost a German labor-court challenge to the dismissal after a lengthy process that he says severely damaged his mental health (he has stated he received treatment in a psychiatric hospital). In that same disclosure he also acknowledged that earlier public claims he had made -- that Microsoft had taken legal action against him -- were fabricated, a credibility caveat this record notes without independently verifying any of his self-reported biographical claims. He has framed the release cadence as tied to the employment dispute; Microsoft, contacted by reporters, did not immediately comment on BigDiskBuster.

Defensive impact: because this is a local resource-exhaustion and file-locking technique rather than a memory-safety bug, no memory corruption or code execution primitive is granted -- the impact is purely availability-focused, degrading a Defender endpoint's ability to receive current threat intelligence and thereby creating a detection/response blind spot for any subsequent, unrelated attack on the same host. Recommended detection/mitigation centers on monitoring free-disk-space collapses on the system volume, hidden large temp-file creation (including GUID-formatted hidden files/directories in %TEMP%), anomalous long-lived restrictive handles on MRT.exe, and absence of expected Defender Operational log Event ID 2000 / presence of error 0x80070643, combined with forcing updates via managed channels (Windows Update, WSUS, Windows Security app, or MpCmdRun.exe) and application-control policies (WDAC/AppLocker) to limit which binaries can execute locally in the first place; incident responders are additionally advised to preserve process and file-handle telemetry before terminating the offending process and recovering disk capacity.