Researcher publishes BigDiskBuster zero-day that blocks Microsoft Defender updates

A proof-of-concept tool that prevents Microsoft Defender from installing platform and signature updates by filling all available disk space was published on GitHub on September 19. The tool, called BigDiskBuster, has no patch, no CVE and no Microsoft advisory.

Its author, Abdelhamid Naceri, is a former Microsoft security researcher who says he was dismissed from the company’s Security Response Center in 2024 and has released exploits without coordinating with Microsoft since April. His earlier Defender tools, BlueHammer, RedSun and UnDefend, were all exploited in live intrusions before being patched, and CISA added all three to its Known Exploited Vulnerabilities catalog.

BigDiskBuster watches Defender’s update paths on the C: drive. When an update begins downloading, it creates a hidden temporary file sized to consume all remaining free space, causing the update to fail; once Defender clears its staging directory, the tool deletes the file and waits for the next attempt. It also opens a handle on MRT.exe to block Windows Update from replacing it.

Naceri describes the tool as buggy and in need of rewriting, and says it appears to work on all supported Windows versions. No independent researcher has confirmed the claimed behaviour, and no patch or vendor workaround exists.