Back

BigDiskBuster Tool Blocks Microsoft Defender Updates, No Patch Issued

lite News Desk 2 min read

At a glance

  • BigDiskBuster was published on GitHub on September 21, 2026.
  • The tool prevents Microsoft Defender Antivirus from updating.
  • No CVE identifier or patch exists for BigDiskBuster as of September 23, 2026.

On September 21, 2026, security researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released a proof-of-concept tool called BigDiskBuster that interferes with Microsoft Defender Antivirus updates.

The tool was made available on GitHub and is designed to stop both platform and signature updates for Microsoft Defender by manipulating system resources. This action leaves the antivirus software unable to update while the tool is running.

BigDiskBuster functions by monitoring the update process and creating a hidden temporary file that fills all available disk space when an update begins. It also restricts access to MRT.exe, which blocks the replacement of this file during the update attempt.

The researcher stated that the tool appears to work on all supported versions of Windows, though it is described as buggy and in need of further development. The method used by BigDiskBuster is different from Naceri’s earlier tool, UnDefend, which was addressed by Microsoft in May 2026.

What the numbers show

  • BigDiskBuster was published on September 21, 2026.
  • No CVE identifier had been assigned as of September 23, 2026.
  • Microsoft patched UnDefend in May 2026 as CVE-2026-45498.

As of September 22-23, 2026, Microsoft has not issued a security advisory or patch for the BigDiskBuster tool. Independent reports confirm that neither a patch nor a CVE identifier has been released for this issue.

BigDiskBuster’s approach is distinct from previous exploits, as it targets the update process by consuming all free disk space and locking essential files, rather than relying solely on uncontrolled resource consumption.

The earlier UnDefend proof-of-concept, also developed by Naceri, was addressed by Microsoft with a patch in May 2026. However, it is not clear from available information whether the same patch mitigates the BigDiskBuster technique.

At the time of publication, there is no official response or advisory from Microsoft regarding the BigDiskBuster tool. The situation remains unchanged with no mitigation steps or updates announced by the company.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Group-IB reported RemControl, an Android malware targeting users in Europe, Canada, and the Middle East through fraudulent Google Play apps.

  2. F5 issued a security advisory on September 22, 2026, confirming active exploitation of a critical BIG-IP vulnerability allowing remote code execution.

  3. A ransomware attack on GPAA systems accessed 168,000 records. Full restoration was completed by June 21, 2024, according to agency statements.

  4. Check Point issued emergency hotfixes on September 22, 2026, for a critical vulnerability (CVE-2026-93616) affecting its Management Server.

  5. KISA is enhancing national cybersecurity through AI and big data for vulnerability management, promoting security product commercialization, according to reports.