New Zero-Day Exploit Blocks Microsoft Defender Updates

• •BigDiskBuster blocks Microsoft Defender updates by filling disk space.
• •The exploit affects all supported Windows versions and has no current patch.
• •Naceri has a history of releasing multiple Defender exploits since April 2026.

Abdelhamid Naceri released a zero-day exploit named BigDiskBuster that prevents Microsoft Defender from installing updates by filling disk space. The tool, published on GitHub on September 19, has no patch or CVE associated with it. Naceri, a former Microsoft security researcher, has a history of releasing exploits, including UnDefend, which was patched in May 2026. BigDiskBuster works on all supported Windows versions and operates by creating hidden temporary files to fill disk space during update attempts. The exploit could leave systems vulnerable due to outdated definitions. Microsoft has not yet issued a response or patch for this new vulnerability. Administrators are advised to monitor Defender update failures and check for low disk space. No independent verification of the tool's functionality has been reported yet.