Overview
- Over the weekend the researcher Abdelhamid Naceri released BigDiskBuster on GitHub as a proof‑of‑concept that prevents Windows Defender from completing platform and signature updates while it runs.
- The PoC works by watching Defender update folders and creating a hidden temporary file sized to fill remaining free space so downloads fail and Defender’s signatures can grow stale.
- Naceri says the code appears to run on supported Windows versions but is buggy and its behavior has not been independently confirmed, and Microsoft has not issued a CVE, patch, or public advisory.
- Naceri has published a rapid series of Defender and Windows PoCs since April 2026 after a disputed departure from Microsoft, and some earlier flaws were later patched while others remain unpatched.
- The release raises practical risk for administrators because even unstable public PoCs can be adapted into real attacks, so teams should check Defender version status, watch for repeated update failures and low disk space, and restrict execution of unknown binaries.