Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
A former Microsoft security researcher, Abdelhamid Naceri, has released a zero-day proof-of-concept tool, BigDiskBuster, that effectively blocks Microsoft Defender from updating. This tool, released after his dismissal from Microsoft in 2024, fills the system's disk space to prevent Defender from installing updates, rendering the antivirus ineffective. The tool is similar to previous exploits he developed, and Microsoft has not yet confirmed whether the May patch covers this new technique.
A zero-day proof-of-concept tool, called BigDiskBuster, has been published on GitHub, designed to prevent Microsoft Defender from installing platform and signature updates by filling all available disk space. The tool, created by Abdelhamid Naceri, a former Microsoft security researcher, was released following his dismissal from Microsoft's Security Response Center in 2024. Naceri has been releasing Defender and Windows flaws monthly since April, with his previous tools – BlueHammer, RedSun, and UnDefend – all exploited in live intrusions before Microsoft patched them and CISA added them to its Known Exploited Vulnerabilities catalog.
BigDiskBuster monitors the C:\ drive for new directories under Defender's update paths. When Defender begins downloading a platform or definition update, the tool creates a hidden temporary file sized to fill all remaining free space, and the update fails. Once the update fails and Defender removes its staging directory, the tool deletes the file and waits for the next attempt. It also opens a handle on MRT.exe, the Windows Malicious Software Removal Tool, in a way that would block Windows Update from replacing it.
Naceri describes the tool as "a bit buggy and needs some rewritting" and says it seems to work on all supported Windows versions. No independent researcher has confirmed the claimed behavior. He calls BigDiskBuster "similar to UnDefend," a Defender denial-of-service flaw he disclosed in April that blocked definition updates through a different method. Microsoft patched it in May as CVE-2026-45498 in Antimalware Platform version 4.18.26040.7.
BigDiskBuster is similar to UnDefend, which used uncontrolled resource consumption, while BigDiskBuster fills the disk so Defender's update directories cannot grow. Whether the May patch also covers this new technique is not established, and the different mechanism suggests it does not.
What Defenders Should Do No patch or vendor workaround exists for BigDiskBuster. Administrators can check that Defender's signatures and platform version are current through Windows Security under Virus & threat protection, then Protection updates, then Check for updates. In PowerShell, Get-MpComputerStatus shows the current versions in the AMEngineVersion and AMProductVersion fields. Monitoring for repeated Defender update failures, sustained low disk space on the system volume, and large hidden files in temporary directories would help detect the technique. Restricting execution of unknown binaries through WDAC or AppLocker would limit an attacker's ability to run the tool.