An unpatched zero-day tool named BigDiskBuster, which prevents Microsoft Defender from carrying out platform and signature updates by consuming all available disk space, was made public on GitHub on September 19. The tool, created by former Microsoft security researcher Abdelhamid Naceri, has neither a patch nor a CVE, and Microsoft has yet to release an advisory regarding this vulnerability.
Background on BigDiskBuster
Naceri, who was previously part of Microsoft’s Security Response Center until his dismissal in 2024, has been releasing exploits without coordination with the company since April. His prior tools have been involved in live attacks before Microsoft issued patches, with his creations being listed in CISA’s Known Exploited Vulnerabilities catalog.
The newly disclosed BigDiskBuster operates by monitoring the C: drive for new directories under Defender’s update paths. When an update is initiated, the tool generates a hidden temporary file to occupy the entire available disk space, causing the update process to fail. Once the update attempt is unsuccessful, the tool deletes the file and awaits the next update effort. It also obstructs Windows Update by holding a handle on MRT.exe, the Windows Malicious Software Removal Tool.
Comparing BigDiskBuster and Prior Tools
Naceri likens BigDiskBuster to a previous tool, UnDefend, which he released in April. While both tools aim to disrupt Defender updates, UnDefend did so through uncontrolled resource consumption, whereas BigDiskBuster fills the disk to impede directory growth. Microsoft addressed the UnDefend flaw in May with a patch identified as CVE-2026-45498.
Despite the differences in technique, it remains uncertain whether the May patch also mitigates BigDiskBuster’s approach. As of now, no independent researchers have verified Naceri’s claims about the tool’s functionality.
Recommendations for Security Administrators
Currently, no official patch or vendor workaround exists for BigDiskBuster, posing an ongoing risk to systems running Microsoft Defender. Administrators are advised to ensure that Defender’s signatures and platform versions remain up-to-date. This can be verified via Windows Security under the Virus & threat protection section or through PowerShell commands like Get-MpComputerStatus.
To detect potential misuse of BigDiskBuster, administrators should monitor for repeated Defender update failures, consistently low disk space on system volumes, and the presence of large hidden files in temporary directories. Employing security measures such as Windows Defender Application Control (WDAC) or AppLocker to restrict the execution of unknown binaries can also help mitigate the risk of attack.
As the cybersecurity community awaits a response from Microsoft, vigilance and proactive security practices remain essential to safeguard systems from this zero-day threat.
