BigDiskBuster Zero-Day: What the Defender Update-Blocking PoC Really Does

BigDiskBuster is a newly published proof of concept that claims to stop Microsoft Defender Antivirus from installing platform and security-intelligence updates. Our static review found code that watches Defender update directories, temporarily consumes nearly all free space on the Windows system drive with hidden delete-on-close files, and holds MRT.exe open with restrictive sharing. That is a serious update-denial technique—but it is not a remote break-in, ransomware campaign, or confirmed in-the-wild exploit.[1][2]

What researchers released

The repository was created on September 19 under the name BigDiskBuster. Its author describes it as a Windows Defender update denial-of-service proof of concept, similar in objective to the earlier UnDefend flaw, and says it “seems to work on all supported Windows versions” while warning that the code is buggy and needs rewriting.[1] That all-versions statement is the researcher’s claim; it is not a Microsoft product matrix or an independently reproduced test result.

The original GitHub repository returned 404 during our September 23 check. A public Project NightCrawler mirror retained the three-commit repository, including the README and C++ source used for our static review. We did not compile or execute the proof of concept.

How BigDiskBuster works

1. It watches Defender’s update locations. The code monitors directory activity under Defender’s Platform and Definition Updates paths on the C: drive.
2. It reacts when update activity appears. It calculates free volume space and creates GUID-named hidden temporary files sized to consume the available capacity. Those files use delete-on-close behavior, so closing their handles releases the space.
3. It tries to keep the drive starved. Helper threads can allocate newly freed space while the update attempt changes files or directories.
4. It also opens the Malicious Software Removal Tool. The source opens Windows\System32\MRT.exe while permitting only read sharing, which can obstruct another process that needs write or delete sharing.
5. It must remain active. Reporting from BleepingComputer says the researcher described the tool as needing to run in the background to continue blocking Defender updates.[2]

This is best classified as a local update-denial proof of concept. The source does not provide a remote delivery mechanism, persistence system, command-and-control channel, data theft capability, or ransomware payload. It targets the resources that Defender’s updater needs after some other path has already caused the program to run.

Why stale Defender updates matter

Microsoft ships Defender security-intelligence updates as KB2267602 and platform updates as KB4052623. Microsoft documents multiple delivery paths, including Windows Update, WSUS, Configuration Manager, file shares, the Windows Security app, PowerShell, and MpCmdRun.exe.[4] BigDiskBuster’s claimed impact is on local staging and installation, so merely changing the download source would not necessarily overcome a deliberately full system drive.

A successfully disrupted endpoint may still show Defender and real-time protection as enabled while its engine, platform, or security intelligence ages. That gap matters because regular security-intelligence updates contain current malware detection information, and platform updates service Defender itself. The technique does not prove that existing protection instantly stops working; it creates the risk that protection becomes progressively stale.

Filling the system drive can also affect Windows and applications beyond Defender. Abrupt low-space conditions may cause unrelated update, logging, browser, profile, and application failures. Those are possible consequences of disk exhaustion—not proof that BigDiskBuster ran.

Who is potentially exposed?

What BigDiskBuster is not

• Not a remote zero-click attack: the published code must execute on the endpoint.
• Not a Defender shutdown: its stated goal is to block updates, not switch off the antivirus service.
• Not demonstrated code execution through Defender: the PoC is already-running local code interfering with servicing.
• Not proof of compromise: an update error or low disk space has many ordinary causes.
• Not a confirmed “all Windows versions” vulnerability: that remains a researcher claim without a vendor matrix.

How to check a Windows PC safely

Open PowerShell and use Microsoft’s read-only status cmdlet:

Get-MpComputerStatus | Select-Object AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,AMProductVersion,AMEngineVersion,AntivirusSignatureVersion,AntivirusSignatureLastUpdated,AntivirusSignatureAge

Microsoft documents Get-MpComputerStatus as the supported cmdlet for reading antimalware status, including product, engine, signature version, update time, and signature age.[5] A single old timestamp is not proof of attack; compare it with your normal update cadence and investigate repeated failures.

Then check free space without changing the machine:

Get-Volume -DriveLetter C | Select-Object DriveLetter,SizeRemaining,Size

In Event Viewer, inspect Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational. Microsoft identifies Event ID 2000 as a successful security-intelligence update, 2001 as a failed security-intelligence update, 2002/2003 as engine update success/failure, and 2006 as platform update failure.[6]

Detection: look for a timeline, not one magic IOC

No vendor-published unique indicator of compromise is available. A stronger triage pattern would combine:

• an unknown process that stays active in the background;
• Defender platform or definition-update activity;
• a sudden drop in C: free space followed by rapid recovery;
• large hidden GUID-named files created beneath the executing user’s temporary directory and held open for deletion;
• an unusual process handle to MRT.exe that allows read sharing but denies write/delete sharing;
• repeated Defender Events 2001, 2003, or 2006; and
• a security-intelligence timestamp or platform version that stops advancing across repeated update windows.

Disk-pressure alerts, update failures, or error 0x80070643 alone are weak indicators because ordinary storage, Windows Update, proxy, WSUS, and servicing problems can produce similar symptoms. Preserve process telemetry, file-creation events, Defender logs, Windows Update logs, free-space history, and EDR timelines before deleting files or rebooting a suspected endpoint.

Mitigation while there is no BigDiskBuster-specific patch

1. Do not run the PoC on a production PC. It intentionally exhausts the system drive and can disrupt more than Defender.
2. Restrict untrusted code execution. Use App Control for Business or AppLocker where appropriate, and remove local administrator rights from daily-use accounts. Microsoft says application control can restrict which executables, scripts, installers, and other code are trusted to run.[7]
3. Alert on Defender update age and failure. A running antivirus icon is not sufficient. Monitor the last successful signature, engine, and platform update across endpoints.
4. Alert on abrupt system-drive exhaustion. Correlate it with process and file telemetry instead of treating every low-space event as hostile.
5. Keep Windows and Defender current. Current updates do not constitute a confirmed BigDiskBuster fix, but they reduce unrelated attack paths and keep the endpoint ready for Microsoft’s eventual servicing guidance.
6. Use supported update recovery. After containing suspicious local code and restoring safe free space, administrators can invoke Update-MpSignature or use Windows Security’s update control, then verify that version and timestamp actually changed.[8]
7. Escalate repeat failures. Microsoft’s troubleshooting flow recommends verifying update connectivity and services, testing supported alternate sources, collecting diagnostic data, and contacting Microsoft support when update failures persist.[9]

Recovery and verification

1. Isolate a suspicious endpoint if an unknown process is actively exhausting disk space.
2. Preserve process, file, Defender, Windows Update, and EDR evidence before cleanup.
3. Terminate or contain the unauthorized program using your normal incident-response tooling; do not run public exploit code to “test” the machine.
4. Confirm free space remains stable after the suspicious process is gone.
5. Run a supported Defender update and record the before/after product, engine, platform, and signature versions.
6. Require a new Event 2000 for successful security-intelligence update and investigate any continuing 2001, 2003, or 2006 events.
7. Confirm no persistence mechanism relaunches the process and review how the code first reached the endpoint.

Patching or restoring updates closes only the immediate update gap. If the process arrived through compromised credentials, remote-management abuse, malicious software, or another exploit, that initial-access path still requires investigation and remediation.

FAQ

Is BigDiskBuster really a zero-day?

It is being reported as a zero-day because public proof-of-concept code describes a previously unpatched Defender update-denial technique. However, there is no CVE or Microsoft advisory specifically confirming BigDiskBuster at our cutoff, so the most precise label is public, unconfirmed local zero-day claim with a concrete PoC.

Does it disable Microsoft Defender?

Not directly. The published design targets update servicing. Existing protection can remain enabled while its security intelligence or platform stops advancing.

Can a website exploit it?

The published PoC contains no browser or remote-delivery path. An attacker would first need some way to execute code locally.

Should I delete temporary files if I see low disk space?

Do not start with blind deletion on a potentially compromised system. Capture evidence and identify the process holding the files. Because the PoC uses delete-on-close behavior, stopping the responsible process may release space, but ordinary temporary files and unrelated failures can look similar.

Is there a patch?

We found no official BigDiskBuster-specific patch as of September 23, 2026, 9:25 AM Eastern. Continue installing supported Windows and Defender updates and watch Microsoft’s live security guidance for a confirmed fix.

Sources

1. NightmareEclipse/BigDiskBuster repository mirror — README, source, and three-commit history; retrieved September 23, 2026.
2. BleepingComputer: New Windows Defender zero-day blocks Microsoft antivirus updates — September 22, 2026.
3. SecurityWeek: Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity — September 22, 2026.
4. Microsoft: Defender Antivirus security intelligence and product updates.
5. Microsoft: Get-MpComputerStatus.
6. Microsoft: Defender Antivirus event IDs and error codes.
7. Microsoft: Application Control for Windows.
8. Microsoft: Update-MpSignature.
9. Microsoft: Security-intelligence update troubleshooting.

Reporting cutoff: September 23, 2026, 9:25 AM Eastern. This article is defensive guidance. We reviewed the public source statically and did not compile or execute it. Microsoft’s future advisory or fixed-version information should supersede this point-in-time report.