A researcher has published a proof-of-concept that disables Microsoft Defender’s ability to update by filling the system drive with junk data.
BigDiskBuster landed on GitHub on September 19 with no patch, no CVE number and no word from Microsoft. The author, Abdelhamid Naceri, is a former insider at the vendor. He says his 2024 exit from its Security Response Center was a dismissal, and that since April he has shipped exploits with no advance notice to Redmond.
The mechanism is blunt, and it leans on denial rather than exploitation. Defender stages incoming packages on the C: drive, so the tool keeps that area under watch. The instant a definition or platform build starts to arrive, a hidden file sized to absorb every remaining free byte appears, and the download collapses. Once the staging area is cleared the file vanishes and the tool awaits the next attempt. A further step holds MRT.exe open, which keeps the cleaner from being swapped out by an update.
Defender keeps running, but its signature and platform data go stale. Naceri calls the tool buggy and in need of rewriting, and no independent researcher has confirmed the behaviour.
Three earlier Naceri tools, BlueHammer, RedSun and UnDefend, were all exploited in the wild, patched and later added to CISA’s Known Exploited Vulnerabilities catalog. UnDefend, tracked as CVE-2026-45498, was fixed in May. BigDiskBuster uses a different method, so that fix may not cover it.
Administrators can check signature freshness with Get-MpComputerStatus and watch for repeated update failures or large hidden temporary files. Restricting unknown binaries through WDAC or AppLocker narrows the attack surface.
