Former Microsoft Researcher Releases BigDiskBuster PoC to Exhaust Disk Space and Block Defender Updates

The PoC watches Defender staging directories and spawns files sized to exhaust free space exactly when updates begin, then cleans up after failure. It also holds an open handle on MRT.exe to block Windows Update replacement. No CVE or patch exists; the mechanism differs from Naceri's earlier UnDefend (CVE-2026-45498), which relied on uncontrolled resource consumption rather than disk exhaustion, indicating the May patch does not cover this variant.

Naceri's prior releases—BlueHammer, RedSun, and UnDefend—were each added to CISA's Known Exploited Vulnerabilities catalog after observed intrusions. Contract and job records show his 2024 dismissal from MSRC preceded the April shift to uncoordinated monthly disclosures. Procurement patterns at Microsoft indicate continued reliance on signature freshness that BigDiskBuster directly targets.

Independent confirmation remains absent, yet the technique aligns with documented low-disk DoS vectors in endpoint telemetry. Administrators should monitor Get-MpComputerStatus for stale AMEngineVersion values alongside repeated update failures and anomalous hidden files in %ProgramData%\Microsoft\Windows Defender.

WDAC policies restricting unsigned binaries and disk-space alerts on the system volume provide immediate controls. Expect Microsoft to address the gap in the next Antimalware Platform release once exploitation telemetry surfaces.