Microsoft Malware Protection Engine update leaks 8 bytes per SpyNet call in mpengine.dll

Microsoft released the patch on Wednesday to close the RoguePlanet zero-day in the Malware Protection Engine used by Defender. The update adds defense-in-depth changes that NightmareEclipse identified as introducing an 8-byte leak when mpengine.dll attempts file opens under specific SpyNet conditions. Automatic deployment began without user action and includes additional security feature updates.

The researcher demonstrated that the new code path bypasses Defender's normal file-size quarantine limits. SpyNet reporting functions continue to cache local copies of Zone.Identifier alternate data streams regardless of size, allowing repeated writes that accumulate until storage is full. This occurs even when real-time protection is disabled and affects both Windows 10 and 11.

The flaw connects to prior NightmareEclipse disclosures that forced rapid Microsoft responses. Operational impact includes silent consumption of system and user data partitions within weeks of exposure on unpatched endpoints. Microsoft has not issued a follow-up advisory addressing the side effect, leaving administrators to monitor disk metrics or block the update pending a revised engine build.