Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates

Unpatched Tool Starves Defender of Disk Space to Stall Updates

A researcher has published a proof-of-concept tool on GitHub that permanently blocks Microsoft Defender from installing platform and signature updates by deliberately exhausting available disk space. The tool, named BigDiskBuster, went live on September 19 and carries no CVE identifier, no Microsoft security advisory, and — as of this writing — no patch.

Tool Summary

How BigDiskBuster Works

BigDiskBuster does not touch Defender's detection engine directly. Instead, it watches the C:\ drive for activity in Defender's update staging directories. The moment Defender begins downloading a platform or definition update, the tool creates a large hidden temporary file sized to consume all remaining free space on the volume — leaving the update process with nowhere to write its staged files, so the install fails.

Once the update attempt fails and Defender tears down its staging directory, BigDiskBuster deletes its own filler file to avoid drawing attention, then sits idle waiting for the next update cycle to repeat the process. The author also notes the tool opens a handle on MRT.exe, the Windows Malicious Software Removal Tool, in a way intended to prevent Windows Update from replacing that binary.

Critically, Defender itself keeps running throughout — there is no crash, no disabled service, and no obvious error banner beyond a stale signature date. The tool simply freezes Defender's protection content in place for as long as it runs in the background, leaving endpoints exposed to any threat published after the last successful update.

The author has described the release as "a bit buggy and needs some rewriting," and says it appears to function across all currently supported versions of Windows, though that claim has not been independently verified by Microsoft or third parties.

The Researcher Behind It

BigDiskBuster's author, Abdelhamid Naceri, is a well-known name in Windows security research with a long history of privilege-escalation and Defender-related zero-day disclosures. Naceri says he was dismissed from Microsoft's Security Response Center in 2024, and has released a string of uncoordinated, unpatched Windows disclosures since roughly April 2026 — targeting Defender, BitLocker, and other core Windows components amid an ongoing dispute with Microsoft over the circumstances of his departure.

BigDiskBuster is not Naceri's first attempt at blinding Defender's update mechanism. He has drawn a direct comparison to an earlier tool he released in April, called UnDefend, which allowed a standard user to block signature updates through a different technique. According to Naceri, three of his earlier Defender-focused tools were subsequently observed being used in real-world intrusions before Microsoft shipped fixes and CISA added them to its Known Exploited Vulnerabilities catalog. Some of his other disclosures from this same run have since been patched by Microsoft, while others — including BigDiskBuster — remain open.

Why This Matters

Three factors combine to make BigDiskBuster more than an academic curiosity for defenders:

• No CVE and no advisory. Without a tracked identifier, the flaw won't surface in standard vulnerability feeds, KEV catalog monitoring, or most vulnerability management dashboards.
• No patch timeline. Microsoft has not issued guidance or confirmed a fix is in progress, so there is currently no supported remediation path — only mitigation.
• A believable "silent" failure mode. Because Defender keeps running and reports no dramatic error, an endpoint can sit for an extended period with stale signatures while still appearing "protected" to a casual glance at Windows Security.

There is no public evidence yet that BigDiskBuster has been used in live attacks, unlike three of Naceri's earlier Defender tools. But given that history, and the fact the code and technique are now public with no patch available, defenders should treat this as a live exposure rather than a theoretical one.

Protective Measures

Until Microsoft ships a fix, treat this as a monitoring and defense-in-depth problem rather than one you can simply patch away:

1. Monitor Defender signature versions directly. Don't rely on the absence of alerts — actively check signature and platform version timestamps fleet-wide via Windows Security, PowerShell (Get-MpComputerStatus), or your endpoint management console, and flag hosts that haven't updated within the expected window.
2. Alert on sustained low free-disk-space conditions, especially on the system volume, and on repeated Defender update failures in the Windows Event Log — both are the visible fingerprints of this technique.
3. Add disk-quota and free-space monitoring to existing infrastructure alerting so an artificially filled volume triggers the same response as an organically full one.
4. Restrict execution of unknown or unsigned binaries with Windows Defender Application Control (WDAC) or AppLocker — BigDiskBuster still has to run as a background process to maintain the block, so execution controls remain an effective containment layer.
5. Don't rely on Defender alone. Layer in an independent EDR product and offline/immutable backups so a single blinded AV engine doesn't become a single point of failure for detection or recovery.

This is a developing story — CosmicBytez Labs will update this article if Microsoft issues an advisory, CVE, or patch for BigDiskBuster.