BigDiskBuster Zero-Day PoC Published, Blocks Microsoft Defender Updates

On September 19, 2026, a zero-day proof-of-concept tool named BigDiskBuster was published on GitHub by Abdelhamid Naceri, a former Microsoft security researcher. The tool exploits a design limitation in Microsoft Defender's update mechanism by consuming all available disk space on the host system. This action prevents Microsoft Defender from installing platform and signature updates, leaving endpoints without critical security protections. The publication notes that the tool has no associated CVE, no patch, and no Microsoft advisory. As of the disclosure date, no active exploitation of BigDiskBuster in the wild has been reported, though the technique poses a significant risk to endpoint security by disabling Defender's ability to receive updates. The author's earlier Defender exploits were previously used in real-world attacks, though independent confirmation of real-world exploitation of BigDiskBuster is currently lacking.