BigDiskBuster PoC Blocks Microsoft Defender Antivirus Updates via Disk-Space Exhaustion
BigDiskBuster PoC Blocks Microsoft Defender Antivirus (TL-2026-2618), also tracked as BigDiskBuster PoC, is a medium-severity software vulnerability, first published 2026-09-22. It is attributed to NightmareEclipse with high confidence, affects Microsoft Microsoft Defender Antivirus (Antimalware Platform /, maps to 8 MITRE ATT&CK techniques (T1070.004, T1082, T1204.002), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-2618
- Threat ID
- TL-2026-2618
- Also known as
- BigDiskBuster PoC
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-22
- Last reviewed
- 2026-09-22
- Attribution
- NightmareEclipse
- Attribution confidence
- HIGH
- Motivation
- HACKTIVISM
- Target sectors
- cross-sector
- Target regions
- global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in BigDiskBuster PoC Blocks Microsoft Defender Antivirus
Malware and tooling: BigDiskBuster, BlueHammer, FalconFlank, GreenSection, HardBreacher, PrettyPrague, RedSun, UnDefend
Former Microsoft Security Response Center researcher Abdelhamid Naceri (NightmareEclipse / Chaotic Eclipse / MSNightmare) publicly released BigDiskBuster, a C++ proof-of-concept that watches Microsoft Defender Antivirus's update staging paths and fills all remaining free disk space with hidden delete-on-close files the moment a platform or security-intelligence update begins, forcing the update to fail and leaving Defender on stale threat definitions. No CVE has been assigned and no Microsoft advisory exists as of publication.
How BigDiskBuster PoC Blocks Microsoft Defender Antivirus works
BigDiskBuster is a Windows Defender Antivirus denial-of-service proof-of-concept published to GitHub (github.com/MSNightmare/BigDiskBuster, MIT-licensed, implemented in a single C++ source file 'BigDiskBuster.cpp', 3 commits, 168 stars, 27 forks, 1 open issue) on or around September 19, 2026 by Abdelhamid Naceri, a former Microsoft Security Response Center researcher who worked for Microsoft's UK and Germany operations before being terminated in 2024. Naceri says the dismissal came 'abruptly and without providing a clear justification'; he rejected multiple financial settlement offers and challenged the termination in German labor court, alleging Microsoft presented 'shifting arguments throughout the proceedings.' The court upheld the termination, leaving him with minimal compensation after a costly legal battle he says damaged his mental health severely enough to require psychiatric hospital treatment. He publicly revealed his real identity around September 12, 2026, roughly a week before releasing BigDiskBuster, and in the same disclosure admitted fabricating earlier claims that Microsoft had sued him.
The tool's author describes it as 'similar to UnDefend' (his own earlier Defender DoS PoC, patched by Microsoft as CVE-2026-45498 in the out-of-band Antimalware Platform 4.18.26040.7 update on May 21, 2026, alongside the related CVE-2026-41091 — a separate local-privilege-escalation flaw in the Microsoft Malware Protection Engine caused by improperly resolving links before accessing files, fixed in engine version 1.1.26040.8. Both CVEs were confirmed exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, with a federal civilian-agency remediation deadline of June 3, 2026, alongside Naceri's earlier BlueHammer (CVE-2026-33825, CVSS 7.8) and RedSun.
BigDiskBuster monitors the C:\ volume for new directories appearing under Defender's platform- and definition-update staging paths. The instant an update begins, it checks available disk capacity and creates a hidden, delete-on-close temporary file in the user's Temp directory sized to consume all remaining free space; if capacity is freed mid-update, additional worker threads race to reclaim it, repeatedly starving the installer until it fails with the generic Windows Security installation error 0x80070643 (the researcher and reporting both note this error code has multiple unrelated possible causes and should be corroborated with other telemetry before being attributed to the tool). Once Defender tears down its staging directory following the failed attempt, BigDiskBuster deletes its own hidden file to free the disk again and waits for the next update attempt, repeating indefinitely. Independently of the disk-exhaustion loop, the tool also opens a handle on MRT.exe (the Windows Malicious Software Removal Tool) with restrictive sharing permissions, denying other processes write or delete access while the handle is held open, which blocks Windows Update from replacing that binary. The author characterizes the current release as 'a bit buggy and needs some rewritting' and claims — without independent verification — that it works on all currently supported Windows versions. As of publication there is no confirmed in-the-wild deployment of BigDiskBuster itself and no independent researcher has confirmed the claimed behavior, though the researcher's prior Defender tools (BlueHammer, RedSun, UnDefend) were each confirmed exploited by other threat actors after release, establishing a pattern in which his uncoordinated PoCs are weaponized within weeks.
Naceri's broader 2026 release cadence — nearly a dozen uncoordinated zero-days since April — extends beyond Microsoft: reporting also attributes to him GreenSection (an Nvidia driver memory-corruption flaw), HardBreacher (a Kaspersky Endpoint Security privilege-escalation flaw), PrettyPrague (an Avast Antivirus privilege-escalation flaw), and FalconFlank (a CrowdStrike Falcon privilege-escalation flaw), indicating the pattern of vendor-uncoordinated security-product disclosures is not limited to Microsoft. His earlier BlueHammer and RedSun tools both abused Windows Defender's privileged remediation/cloud-rollback file operations via opportunistic locks (oplocks) combined with NTFS junctions redirecting a temp-directory target path to C:\Windows\System32, letting an attacker overwrite a system binary with SYSTEM privileges via a time-of-check-to-time-of-use race condition — a materially different, code-execution-capable class of bug from BigDiskBuster's pure denial-of-service mechanism, but from the same author and disclosure pattern.
Security reporting recommends defenders verify Defender's current platform/signature versions (Get-MpComputerStatus, checking the AMEngineVersion and AMProductVersion fields), watch for repeated Defender update failures, sustained free-space collapse, unusual hidden files under user Temp directories, persistent open handles on MRT.exe, and a gap in Windows Defender Operational log Event ID 2000 (which normally records successful signature updates), and force updates through Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe if native update paths appear to be interfered with. Recommended response steps include preserving process and file-handle telemetry, terminating suspicious processes, recovering consumed disk space, and validating whether error 0x80070643 instances correlate with a genuine attack versus an unrelated installer fault. WDAC/AppLocker can restrict execution of unrecognized binaries that would otherwise run a tool like this.
MITRE ATT&CK techniques used in TL-2026-2618
Defense Evasion
T1070.004 File Deletion; T1564.001 Hidden Files and Directories
Discovery
T1082 System Information Discovery; T1518.001 Security Software Discovery
Execution
Resource Development
T1587.001 Malware; T1608.001 Upload Malware
defense-impairment
Affected products and versions in BigDiskBuster PoC Blocks Microsoft Defender Antivirus
- Microsoft — Microsoft Defender Antivirus (Antimalware Platform / Security Intelligence updates)
Vulnerable versions: all currently supported Windows versions (per researcher's unverified claim)
Remediation for BigDiskBuster PoC Blocks Microsoft Defender Antivirus
Patches
- No CVE, patch, or Microsoft advisory exists for BigDiskBuster as of publication (2026-09-22)
Immediate actions
- Run Get-MpComputerStatus (or check Windows Security > Virus & threat protection) to confirm the host's current Defender AMEngineVersion/AMProductVersion are not stale
- Monitor Windows Defender Operational log (Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational) for missing/repeated-failure Event ID 2000 entries and Windows Security error 0x80070643, corroborating with other telemetry before attributing to this tool
- Alert on sudden, sustained free-disk-space collapse on endpoints, especially correlated with a Defender update attempt
- Hunt for unusual hidden, delete-on-close files being created and removed in user %TEMP% directories in a repeating pattern
- Check for unexpected long-lived open file handles on MRT.exe (Malicious Software Removal Tool)
- Force a trusted Defender update via Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe -SignatureUpdate if native updates appear blocked
- If exploitation is suspected, preserve process and file-handle telemetry, terminate the suspicious process, and recover consumed disk space before re-attempting the update
Workarounds
- Enforce minimum-free-disk-space alerting/quotas on endpoints so update installers are less likely to be starved
- Restrict local execution of unsigned/unknown binaries on endpoints where Defender is the primary AV control
Longer-term hardening
- Deploy WDAC or AppLocker policies restricting execution of unrecognized/unsigned binaries so a locally-run PoC like BigDiskBuster cannot be launched by a standard user
- Add disk-space-exhaustion-triggered-by-security-update-failure as a monitored EDR/SIEM detection pattern independent of any single tool signature
- Track this researcher's release cadence (nearly a dozen uncoordinated PoCs against Microsoft Defender, Nvidia, Kaspersky, Avast, and CrowdStrike products since April 2026) as a recurring intake source for the vulnerability-management program
- Cross-check CISA's Known Exploited Vulnerabilities catalog for this author's prior CVEs (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498) and confirm the June 3, 2026 remediation deadline was met
Weaknesses (CWE) in BigDiskBuster PoC Blocks Microsoft Defender Antivirus
CWE-400
Timeline of BigDiskBuster PoC Blocks Microsoft Defender Antivirus
- Abdelhamid Naceri says Microsoft terminated his employment from its UK/Germany security operations abruptly and without clear justification; he rejected multiple settlement offers and later disputed the dismissal unsuccessfully in German labor court.
- RedSun, a Defender cloud-file-rollback abuse technique (Windows Cloud Files API + junction + oplock) for SYSTEM-level privilege escalation, is disclosed in the same April 2026 window.
- Naceri (as NightmareEclipse) publicly discloses BlueHammer, a Defender local-privilege-escalation zero-day (TOCTOU race condition via opportunistic lock + NTFS junction) with working PoC, later assigned CVE-2026-33825 (CVSS 7.8) and patched in the April 2026 Patch Tuesday.
- Microsoft ships out-of-band patches (Antimalware Platform 4.18.26040.7, Malware Protection Engine 1.1.26040.8) for CVE-2026-45498 (Naceri's UnDefend, the direct predecessor of BigDiskBuster) and the related link-resolution local-privilege-escalation flaw CVE-2026-41091, after confirming both were being actively exploited.
- Naceri releases RoguePlanet, another uncoordinated Windows Defender-related PoC.
- CISA's Known Exploited Vulnerabilities catalog entries for CVE-2026-41091 and CVE-2026-45498 (added after confirmed in-the-wild exploitation, alongside Naceri's BlueHammer/CVE-2026-33825 and RedSun) set a federal civilian agency remediation deadline of June 3, 2026.
- Naceri releases LegacyHive, continuing the pattern of monthly uncoordinated Defender/Windows component disclosures.
- Naceri releases ShieldBreak.
- Naceri publicly reveals his real identity approximately one week before releasing BigDiskBuster, detailing his disputed Microsoft termination and admitting he had fabricated earlier claims that Microsoft sued him.
- BigDiskBuster is published to GitHub (github.com/MSNightmare/BigDiskBuster) as a single C++ source file, described by its author as similar to UnDefend and 'a bit buggy and needs some rewritting.'
- Naceri also releases ShieldCrash, a further Defender-targeting tool, in the same period as BigDiskBuster.
- The Register, The Hacker News, SecurityWeek, Security Affairs, Cyber Security News, and other outlets report on BigDiskBuster; no CVE or Microsoft advisory exists at time of coverage.
Sources cited for BigDiskBuster PoC Blocks Microsoft Defender Antivirus
- NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
- Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
- Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
- Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day
- MSNightmare Releases New PoC for DoS Vulnerability in Windows Defender
- MSNightmare/BigDiskBuster (GitHub repository / PoC source)
- Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)
- BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Vulnerability Explained
- CISA Known Exploited Vulnerabilities Catalog
More in vulnerability
- Check Point Patches Actively Exploited Zero-Day Path Traversal in Management Server (CVE-2026-93616)
- BigDiskBuster PoC Blocks Windows Defender Signature/Platform Updates (DoS)
- Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (CVE-2026-7273) Actively Exploited by Kapibala/Red Heron in Global 996-Device Campaign — Added to CISA KEV
- Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install
- F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)
Detection coverage for TL-2026-2618
As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2618 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.