A former Microsoft security researcher released a dangerous zero-day on September 19. The BigDiskBuster tool blocks Microsoft Defender from installing critical platform and signature updates. No patch, CVE number, or Microsoft advisory currently exists for this flaw. The vulnerability represents a serious threat to organizations relying on Defender for endpoint security globally.
Abdelhamid Naceri disclosed the exploit publicly on GitHub without coordination with Microsoft. He was dismissed from Microsoft’s Security Response Center in 2024. Since April, Naceri has been releasing Defender and Windows exploits regularly. His previous tools, BlueHammer, RedSun, and UnDefend, were all weaponized in active attacks. Microsoft eventually patched these flaws and CISA added them to Known Exploited Vulnerabilities listings.
BigDiskBuster operates through a fundamentally simple but effective attack mechanism. The tool monitors the C:\ drive for Defender’s update directories continuously. When Defender begins downloading platform or definition updates, BigDiskBuster springs into action. It creates hidden temporary files sized to fill all remaining free disk space. This forces the update to fail immediately, preventing installation. Once Defender removes its staging directory, the tool deletes its files silently. It then waits for the next update attempt and repeats the cycle.
The tool also targets Windows Malicious Software Removal Tool (MRT.exe) by holding handles that would block Windows Update from replacing it. When updates fail repeatedly, Defender keeps running but its detection content grows dangerously stale. The proof-of-concept shows a generic Windows error message when updates are attempted. However, whether automatic alerts trigger on these repeated failures remains unclear currently.
Naceri acknowledges the tool needs work and has bugs requiring fixes. He claims BigDiskBuster works across all supported Windows versions. No independent researcher has confirmed these claims yet. However, the release follows a clear pattern from Naceri of escalating Microsoft attacks methodically.
Organizations should monitor for sustained low disk space on system volumes. Checking Defender’s signature versions regularly through Windows Security settings proves critical. Restricting unknown binary execution through WDAC or AppLocker would limit attacker capabilities. Until Microsoft releases a patch, these detective measures represent essential defensive strategies.
