Researcher Drops Big Disk Buster Zero-Day PoC That Blocks Microsoft Defender Updates
Summary: Abdelhamid Naceri, a former Microsoft security researcher, published a zero-day proof-of-concept on GitHub on September 19 called BigDiskBuster that blocks Microsoft Defender platform and signature updates by filling all available disk space. The tool has no patch, no CVE, and no Microsoft advisory, and it works by watching Defender's update paths and creating a hidden temporary file sized to consume all remaining free space when an update begins, causing the update to fail.
Why it matters: Naceri's first three Defender tools, BlueHammer, RedSun, and UnDefend, were all exploited in live intrusions before Microsoft patched them and CISA added all three to its Known Exploited Vulnerabilities catalog, and whether the May patch for UnDefend covers this different mechanism is not established.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-45498
- Related
- CVE-2026-45498: Microsoft Defender Denial of Service Vulnerability Known Exploited Vulnerabilities · May 20, 2026